From 0dd4e7e1640e36ef2c265ec304c190c2bbd827f5 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Mon, 18 Nov 2013 13:02:11 -0800
Subject: [PATCH 001/144] Bug 928195 - Part 3: Consolidate all WebIDL Python
 logic into mozwebidl module; r=bz, froydnj

--HG--
extra : rebase_source : 050f1c3eb3bccdf369164be4e58c59fa71c19060
---
 build/virtualenv_packages.txt                 |   2 +
 dom/bindings/Makefile.in                      |   2 +
 dom/bindings/mozwebidlcodegen/__init__.py     | 523 ++++++++++++++++++
 .../mozwebidlcodegen/test/Child.webidl        |   3 +
 .../mozwebidlcodegen/test/DummyBinding.webidl |   2 +
 .../test/ExampleBinding.webidl                |   3 +
 .../mozwebidlcodegen/test/Parent.webidl       |   3 +
 .../mozwebidlcodegen/test/TestEvent.webidl    |  13 +
 .../test/test_mozwebidlcodegen.py             | 278 ++++++++++
 9 files changed, 829 insertions(+)
 create mode 100644 dom/bindings/mozwebidlcodegen/__init__.py
 create mode 100644 dom/bindings/mozwebidlcodegen/test/Child.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/Parent.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/TestEvent.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py

diff --git a/build/virtualenv_packages.txt b/build/virtualenv_packages.txt
index aade8e7598e3..4fd374decd99 100644
--- a/build/virtualenv_packages.txt
+++ b/build/virtualenv_packages.txt
@@ -13,6 +13,8 @@ mock.pth:python/mock-1.0.0
 mozilla.pth:build
 mozilla.pth:config
 mozilla.pth:xpcom/typelib/xpt/tools
+mozilla.pth:dom/bindings
+mozilla.pth:dom/bindings/parser
 moztreedocs.pth:tools/docs
 copy:build/buildconfig.py
 packages.txt:testing/mozbase/packages.txt
diff --git a/dom/bindings/Makefile.in b/dom/bindings/Makefile.in
index 8bc94e224f03..a4a029ae5964 100644
--- a/dom/bindings/Makefile.in
+++ b/dom/bindings/Makefile.in
@@ -84,6 +84,8 @@ globalgen_headers_DEST = $(ABS_DIST)/include/mozilla/dom
 globalgen_headers_TARGET := export
 INSTALL_TARGETS += globalgen_headers
 
+PYTHON_UNIT_TESTS += $(srcdir)/mozwebidlcodegen/test/test_mozwebidlcodegen.py
+
 include $(topsrcdir)/config/rules.mk
 
 ifdef GNU_CC
diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
new file mode 100644
index 000000000000..4fc5d3bbd046
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -0,0 +1,523 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This module contains code for managing WebIDL files and bindings for
+# the build system.
+
+from __future__ import unicode_literals
+
+import errno
+import hashlib
+import json
+import logging
+import os
+
+from copy import deepcopy
+
+from mach.mixin.logging import LoggingMixin
+
+from mozbuild.makeutil import Makefile
+from mozbuild.pythonutil import iter_modules_in_path
+from mozbuild.util import FileAvoidWrite
+
+import mozpack.path as mozpath
+
+import WebIDL
+from Codegen import (
+    CGBindingRoot,
+    CGEventRoot,
+    CGExampleRoot,
+    GlobalGenRoots,
+)
+from Configuration import Configuration
+
+
+class BuildResult(object):
+    """Represents the result of processing WebIDL files.
+
+    This holds a summary of output file generation during code generation.
+    """
+
+    def __init__(self):
+        # The .webidl files that had their outputs regenerated.
+        self.inputs = set()
+
+        # The output files that were created.
+        self.created = set()
+
+        # The output files that changed.
+        self.updated = set()
+
+        # The output files that didn't change.
+        self.unchanged = set()
+
+
+class WebIDLCodegenManagerState(dict):
+    """Holds state for the WebIDL code generation manager.
+
+    State is currently just an extended dict. The internal implementation of
+    state should be considered a black box to everyone except
+    WebIDLCodegenManager. But we'll still document it.
+
+    Fields:
+
+    version
+       The integer version of the format. This is to detect incompatible
+       changes between state. It should be bumped whenever the format
+       changes or semantics change.
+
+    webidls
+       A dictionary holding information about every known WebIDL input.
+       Keys are the basenames of input WebIDL files. Values are dicts of
+       metadata. Keys in those dicts are:
+
+       * filename - The full path to the input filename.
+       * inputs - A set of full paths to other webidl files this webidl
+         depends on.
+       * outputs - Set of full output paths that are created/derived from
+         this file.
+       * sha1 - The hexidecimal SHA-1 of the input filename from the last
+         processing time.
+
+    global_inputs
+       A dictionary defining files that influence all processing. Keys
+       are full filenames. Values are hexidecimal SHA-1 from the last
+       processing time.
+    """
+
+    VERSION = 1
+
+    def __init__(self, fh=None):
+        self['version'] = self.VERSION
+        self['webidls'] = {}
+        self['global_depends'] = {}
+
+        if not fh:
+            return
+
+        state = json.load(fh)
+        if state['version'] != self.VERSION:
+            raise Exception('Unknown state version: %s' % state['version'])
+
+        self['version'] = state['version']
+        self['global_depends'] = state['global_depends']
+
+        for k, v in state['webidls'].items():
+            self['webidls'][k] = v
+
+            # Sets are converted to lists for serialization because JSON
+            # doesn't support sets.
+            self['webidls'][k]['inputs'] = set(v['inputs'])
+            self['webidls'][k]['outputs'] = set(v['outputs'])
+
+    def dump(self, fh):
+        """Dump serialized state to a file handle."""
+        normalized = deepcopy(self)
+
+        for k, v in self['webidls'].items():
+            # Convert sets to lists because JSON doesn't support sets.
+            normalized['webidls'][k]['outputs'] = sorted(v['outputs'])
+            normalized['webidls'][k]['inputs'] = sorted(v['inputs'])
+
+        json.dump(normalized, fh, sort_keys=True)
+
+
+class WebIDLCodegenManager(LoggingMixin):
+    """Manages all code generation around WebIDL.
+
+    To facilitate testing, this object is meant to be generic and reusable.
+    Paths, etc should be parameters and not hardcoded.
+    """
+
+    # Global parser derived declaration files.
+    GLOBAL_DECLARE_FILES = {
+        'GeneratedAtomList.h',
+        'PrototypeList.h',
+        'RegisterBindings.h',
+        'UnionConversions.h',
+        'UnionTypes.h',
+    }
+
+    # Global parser derived definition files.
+    GLOBAL_DEFINE_FILES = {
+        'RegisterBindings.cpp',
+        'UnionTypes.cpp',
+    }
+
+    # Example interfaces to build along with the tree. Other example
+    # interfaces will need to be generated manually.
+    BUILD_EXAMPLE_INTERFACES = {
+        'TestExampleInterface',
+        'TestExampleProxyInterface',
+    }
+
+    def __init__(self, config_path, inputs, exported_header_dir,
+        codegen_dir, state_path, cache_dir=None, make_deps_path=None,
+        make_deps_target=None):
+        """Create an instance that manages WebIDLs in the build system.
+
+        config_path refers to a WebIDL config file (e.g. Bindings.conf).
+        inputs is a 3-tuple describing the input .webidl files and how to
+        process them. Members are:
+            (set(.webidl files), set(basenames of exported files),
+                set(basenames of generated events files))
+
+        exported_header_dir and codegen_dir are directories where generated
+        files will be written to.
+        state_path is the path to a file that will receive JSON state from our
+        actions.
+        make_deps_path is the path to a make dependency file that we can
+        optionally write.
+        make_deps_target is the target that receives the make dependencies. It
+        must be defined if using make_deps_path.
+        """
+        self.populate_logger()
+
+        input_paths, exported_stems, generated_events_stems = inputs
+
+        self._config_path = config_path
+        self._input_paths = set(input_paths)
+        self._exported_stems = set(exported_stems)
+        self._generated_events_stems = set(generated_events_stems)
+        self._exported_header_dir = exported_header_dir
+        self._codegen_dir = codegen_dir
+        self._state_path = state_path
+        self._cache_dir = cache_dir
+        self._make_deps_path = make_deps_path
+        self._make_deps_target = make_deps_target
+
+        if (make_deps_path and not make_deps_target) or (not make_deps_path and
+            make_deps_target):
+            raise Exception('Must define both make_deps_path and make_deps_target '
+                'if one is defined.')
+
+        self._parser_results = None
+        self._config = None
+        self._state = WebIDLCodegenManagerState()
+
+        if os.path.exists(state_path):
+            with open(state_path, 'rb') as fh:
+                try:
+                    self._state = WebIDLCodegenManagerState(fh=fh)
+                except Exception as e:
+                    self.log(logging.WARN, 'webidl_bad_state', {'msg': str(e)},
+                        'Bad WebIDL state: {msg}')
+
+    @property
+    def config(self):
+        if not self._config:
+            self._parse_webidl()
+
+        return self._config
+
+    def generate_build_files(self):
+        """Generate files required for the build.
+
+        This function is in charge of generating all the .h/.cpp files derived
+        from input .webidl files. Please note that there are build actions
+        required to produce .webidl files and these build actions are
+        explicitly not captured here: this function assumes all .webidl files
+        are present and up to date.
+
+        This routine is called as part of the build to ensure files that need
+        to exist are present and up to date. This routine may not be called if
+        the build dependencies (generated as a result of calling this the first
+        time) say everything is up to date.
+
+        Because reprocessing outputs for every .webidl on every invocation
+        is expensive, we only regenerate the minimal set of files on every
+        invocation. The rules for deciding what needs done are roughly as
+        follows:
+
+        1. If any .webidl changes, reparse all .webidl files and regenerate
+           the global derived files. Only regenerate output files (.h/.cpp)
+           impacted by the modified .webidl files.
+        2. If an non-.webidl dependency (Python files, config file) changes,
+           assume everything is out of date and regenerate the world. This
+           is because changes in those could globally impact every output
+           file.
+        3. If an output file is missing, ensure it is present by performing
+           necessary regeneration.
+        """
+        # Despite #1 above, we assume the build system is smart enough to not
+        # invoke us if nothing has changed. Therefore, any invocation means
+        # something has changed. And, if anything has changed, we need to
+        # parse the WebIDL.
+        self._parse_webidl()
+
+        result = BuildResult()
+
+        # If we parse, we always update globals - they are cheap and it is
+        # easier that way.
+        created, updated, unchanged = self._write_global_derived()
+        result.created |= created
+        result.updated |= updated
+        result.unchanged |= unchanged
+
+        # If any of the extra dependencies changed, regenerate the world.
+        global_changed, global_hashes = self._global_dependencies_changed()
+        if global_changed:
+            # Make a copy because we may modify.
+            changed_inputs = set(self._input_paths)
+        else:
+            changed_inputs = self._compute_changed_inputs()
+
+        self._state['global_depends'] = global_hashes
+
+        # Generate bindings from .webidl files.
+        for filename in sorted(changed_inputs):
+            basename = mozpath.basename(filename)
+            result.inputs.add(filename)
+            written, deps = self._generate_build_files_for_webidl(filename)
+            result.created |= written[0]
+            result.updated |= written[1]
+            result.unchanged |= written[2]
+
+            self._state['webidls'][basename] = dict(
+                filename=filename,
+                outputs=written[0] | written[1] | written[2],
+                inputs=set(deps),
+                sha1=self._input_hashes[filename],
+            )
+
+        # Process some special interfaces required for testing.
+        for interface in self.BUILD_EXAMPLE_INTERFACES:
+            written = self.generate_example_files(interface)
+            result.created |= written[0]
+            result.updated |= written[1]
+            result.unchanged |= written[2]
+
+        # Generate a make dependency file.
+        if self._make_deps_path:
+            mk = Makefile()
+            codegen_rule = mk.create_rule([self._make_deps_target])
+            codegen_rule.add_dependencies(global_hashes.keys())
+            codegen_rule.add_dependencies(self._input_paths)
+
+            with FileAvoidWrite(self._make_deps_path) as fh:
+                mk.dump(fh)
+
+        self._save_state()
+
+        return result
+
+    def generate_example_files(self, interface):
+        """Generates example files for a given interface."""
+        root = CGExampleRoot(self.config, interface)
+
+        return self._maybe_write_codegen(root, *self._example_paths(interface))
+
+    def _parse_webidl(self):
+        self.log(logging.INFO, 'webidl_parse',
+            {'count': len(self._input_paths)},
+            'Parsing {count} WebIDL files.')
+
+        hashes = {}
+        parser = WebIDL.Parser(self._cache_dir)
+
+        for path in sorted(self._input_paths):
+            with open(path, 'rb') as fh:
+                data = fh.read()
+                hashes[path] = hashlib.sha1(data).hexdigest()
+                parser.parse(data, path)
+
+        self._parser_results = parser.finish()
+        self._config = Configuration(self._config_path, self._parser_results)
+        self._input_hashes = hashes
+
+    def _write_global_derived(self):
+        things = [('declare', f) for f in self.GLOBAL_DECLARE_FILES]
+        things.extend(('define', f) for f in self.GLOBAL_DEFINE_FILES)
+
+        result = (set(), set(), set())
+
+        for what, filename in things:
+            stem = mozpath.splitext(filename)[0]
+            root = getattr(GlobalGenRoots, stem)(self._config)
+
+            if what == 'declare':
+                code = root.declare()
+                output_root = self._exported_header_dir
+            elif what == 'define':
+                code = root.define()
+                output_root = self._codegen_dir
+            else:
+                raise Exception('Unknown global gen type: %s' % what)
+
+            output_path = mozpath.join(output_root, filename)
+            self._maybe_write_file(output_path, code, result)
+
+        return result
+
+    def _compute_changed_inputs(self):
+        """Compute the set of input files that need to be regenerated."""
+        changed_inputs = set()
+        expected_outputs = self.expected_build_output_files()
+
+        # Look for missing output files.
+        if any(not os.path.exists(f) for f in expected_outputs):
+            # FUTURE Bug 940469 Only regenerate minimum set.
+            changed_inputs |= self._input_paths
+
+        # That's it for examining output files. We /could/ examine SHA-1's of
+        # output files from a previous run to detect modifications. But that's
+        # a lot of extra work and most build systems don't do that anyway.
+
+        # Now we move on to the input files.
+        old_hashes = {v['filename']: v['sha1']
+            for v in self._state['webidls'].values()}
+
+        old_filenames = set(old_hashes.keys())
+        new_filenames = self._input_paths
+
+        # If an old file has disappeared or a new file has arrived, mark
+        # it.
+        changed_inputs |= old_filenames ^ new_filenames
+
+        # For the files in common between runs, compare content. If the file
+        # has changed, mark it. We don't need to perform mtime comparisons
+        # because content is a stronger validator.
+        for filename in old_filenames & new_filenames:
+            if old_hashes[filename] != self._input_hashes[filename]:
+                changed_inputs.add(filename)
+
+        # We've now populated the base set of inputs that have changed.
+
+        # Inherit dependencies from previous run. The full set of dependencies
+        # is associated with each record, so we don't need to perform any fancy
+        # graph traversal.
+        for v in self._state['webidls'].values():
+            if any(dep for dep in v['inputs'] if dep in changed_inputs):
+                changed_inputs.add(v['filename'])
+
+        # Ensure all changed inputs actually exist (some changed inputs could
+        # have been from deleted files).
+        return set(f for f in changed_inputs if os.path.exists(f))
+
+    def _binding_info(self, p):
+        """Compute binding metadata for an input path.
+
+        Returns a tuple of:
+
+          (stem, binding_stem, is_event, output_files)
+
+        output_files is itself a tuple. The first two items are the binding
+        header and C++ paths, respectively. The 2nd pair are the event header
+        and C++ paths or None if this isn't an event binding.
+        """
+        basename = mozpath.basename(p)
+        stem = mozpath.splitext(basename)[0]
+        binding_stem = '%sBinding' % stem
+
+        if stem in self._exported_stems:
+            header_dir = self._exported_header_dir
+        else:
+            header_dir = self._codegen_dir
+
+        is_event = stem in self._generated_events_stems
+
+        files = (
+            mozpath.join(header_dir, '%s.h' % binding_stem),
+            mozpath.join(self._codegen_dir, '%s.cpp' % binding_stem),
+            mozpath.join(header_dir, '%s.h' % stem) if is_event else None,
+            mozpath.join(self._codegen_dir, '%s.cpp' % stem) if is_event else None,
+        )
+
+        return stem, binding_stem, is_event, header_dir, files
+
+    def _example_paths(self, interface):
+        return (
+            mozpath.join(self._codegen_dir, '%s-example.h' % interface),
+            mozpath.join(self._codegen_dir, '%s-example.cpp' % interface))
+
+    def expected_build_output_files(self):
+        """Obtain the set of files generate_build_files() should write."""
+        paths = set()
+
+        # Account for global generation.
+        for p in self.GLOBAL_DECLARE_FILES:
+            paths.add(mozpath.join(self._exported_header_dir, p))
+        for p in self.GLOBAL_DEFINE_FILES:
+            paths.add(mozpath.join(self._codegen_dir, p))
+
+        for p in self._input_paths:
+            stem, binding_stem, is_event, header_dir, files = self._binding_info(p)
+            paths |= {f for f in files if f}
+
+        for interface in self.BUILD_EXAMPLE_INTERFACES:
+            for p in self._example_paths(interface):
+                paths.add(p)
+
+        return paths
+
+    def _generate_build_files_for_webidl(self, filename):
+        self.log(logging.INFO, 'webidl_generate_build_for_input',
+            {'filename': filename},
+            'Generating WebIDL files derived from {filename}')
+
+        stem, binding_stem, is_event, header_dir, files = self._binding_info(filename)
+        root = CGBindingRoot(self._config, binding_stem, filename)
+
+        result = self._maybe_write_codegen(root, files[0], files[1])
+
+        if is_event:
+            generated_event = CGEventRoot(self._config, stem)
+            result = self._maybe_write_codegen(generated_event, files[2],
+                files[3], result)
+
+        return result, root.deps()
+
+    def _global_dependencies_changed(self):
+        """Determine whether the global dependencies have changed."""
+        current_files = set(iter_modules_in_path(mozpath.dirname(__file__)))
+
+        # We need to catch other .py files from /dom/bindings. We assume these
+        # are in the same directory as the config file.
+        current_files |= set(iter_modules_in_path(mozpath.dirname(self._config_path)))
+
+        current_files.add(self._config_path)
+
+        current_hashes = {}
+        for f in current_files:
+            # This will fail if the file doesn't exist. If a current global
+            # dependency doesn't exist, something else is wrong.
+            with open(f, 'rb') as fh:
+                current_hashes[f] = hashlib.sha1(fh.read()).hexdigest()
+
+        # The set of files has changed.
+        if current_files ^ set(self._state['global_depends'].keys()):
+            return True, current_hashes
+
+        # Compare hashes.
+        for f, sha1 in current_hashes.items():
+            if sha1 != self._state['global_depends'][f]:
+                return True, current_hashes
+
+        return False, current_hashes
+
+    def _save_state(self):
+        with open(self._state_path, 'wb') as fh:
+            self._state.dump(fh)
+
+    def _maybe_write_codegen(self, obj, declare_path, define_path, result=None):
+        assert declare_path and define_path
+        if not result:
+            result = (set(), set(), set())
+
+        self._maybe_write_file(declare_path, obj.declare(), result)
+        self._maybe_write_file(define_path, obj.define(), result)
+
+        return result
+
+    def _maybe_write_file(self, path, content, result):
+        fh = FileAvoidWrite(path)
+        fh.write(content)
+        existed, updated = fh.close()
+
+        if not existed:
+            result[0].add(path)
+        elif updated:
+            result[1].add(path)
+        else:
+            result[2].add(path)
diff --git a/dom/bindings/mozwebidlcodegen/test/Child.webidl b/dom/bindings/mozwebidlcodegen/test/Child.webidl
new file mode 100644
index 000000000000..f7d0a76c9d3f
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/Child.webidl
@@ -0,0 +1,3 @@
+interface Child : Parent {
+  void ChildBaz();
+};
diff --git a/dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl b/dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl
new file mode 100644
index 000000000000..e2ccc4b69745
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl
@@ -0,0 +1,2 @@
+interface DummyInterface {};
+interface DummyInterfaceWorkers {};
diff --git a/dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl b/dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl
new file mode 100644
index 000000000000..34794993fe4a
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl
@@ -0,0 +1,3 @@
+/* These interfaces are hard-coded and need to be defined. */
+interface TestExampleInterface {};
+interface TestExampleProxyInterface {};
diff --git a/dom/bindings/mozwebidlcodegen/test/Parent.webidl b/dom/bindings/mozwebidlcodegen/test/Parent.webidl
new file mode 100644
index 000000000000..423f364aea23
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/Parent.webidl
@@ -0,0 +1,3 @@
+interface Parent {
+  void MethodFoo();
+};
diff --git a/dom/bindings/mozwebidlcodegen/test/TestEvent.webidl b/dom/bindings/mozwebidlcodegen/test/TestEvent.webidl
new file mode 100644
index 000000000000..db085629186c
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/TestEvent.webidl
@@ -0,0 +1,13 @@
+interface EventTarget {
+  void addEventListener();
+};
+
+interface Event {};
+
+callback EventHandlerNonNull = any (Event event);
+typedef EventHandlerNonNull? EventHandler;
+
+[NoInterfaceObject]
+interface TestEvent : EventTarget {
+  attribute EventHandler onfoo;
+};
diff --git a/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py b/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
new file mode 100644
index 000000000000..fd35e8c63485
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
@@ -0,0 +1,278 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import unicode_literals
+
+import imp
+import json
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+
+import mozpack.path as mozpath
+
+from mozwebidlcodegen import (
+    WebIDLCodegenManager,
+    WebIDLCodegenManagerState,
+)
+
+from mozfile import NamedTemporaryFile
+
+from mozunit import (
+    MockedOpen,
+    main,
+)
+
+
+OUR_DIR = mozpath.abspath(mozpath.dirname(__file__))
+TOPSRCDIR = mozpath.normpath(mozpath.join(OUR_DIR, '..', '..', '..', '..'))
+
+
+class TestWebIDLCodegenManager(unittest.TestCase):
+    TEST_STEMS = {
+        'Child',
+        'Parent',
+        'ExampleBinding',
+        'TestEvent',
+    }
+
+    @property
+    def _static_input_paths(self):
+        s = {mozpath.join(OUR_DIR, p) for p in os.listdir(OUR_DIR)
+            if p.endswith('.webidl')}
+
+        return s
+
+    @property
+    def _config_path(self):
+        config = mozpath.join(TOPSRCDIR, 'dom', 'bindings', 'Bindings.conf')
+        self.assertTrue(os.path.exists(config))
+
+        return config
+
+    def _get_manager_args(self):
+        tmp = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, tmp)
+
+        cache_dir = mozpath.join(tmp, 'cache')
+        os.mkdir(cache_dir)
+
+        ip = self._static_input_paths
+
+        inputs = (
+            ip,
+            {mozpath.splitext(mozpath.basename(p))[0] for p in ip},
+            set()
+        )
+
+        return dict(
+            config_path=self._config_path,
+            inputs=inputs,
+            exported_header_dir=mozpath.join(tmp, 'exports'),
+            codegen_dir=mozpath.join(tmp, 'codegen'),
+            state_path=mozpath.join(tmp, 'state.json'),
+            make_deps_path=mozpath.join(tmp, 'codegen.pp'),
+            make_deps_target='codegen.pp',
+            cache_dir=cache_dir,
+        )
+
+    def _get_manager(self):
+        return WebIDLCodegenManager(**self._get_manager_args())
+
+    def test_unknown_state_version(self):
+        """Loading a state file with a too new version resets state."""
+        args = self._get_manager_args()
+
+        p = args['state_path']
+
+        with open(p, 'wb') as fh:
+            json.dump({
+                'version': WebIDLCodegenManagerState.VERSION + 1,
+                'foobar': '1',
+            }, fh)
+
+        manager = WebIDLCodegenManager(**args)
+
+        self.assertEqual(manager._state['version'],
+            WebIDLCodegenManagerState.VERSION)
+        self.assertNotIn('foobar', manager._state)
+
+    def test_generate_build_files(self):
+        """generate_build_files() does the right thing from empty."""
+        manager = self._get_manager()
+        result = manager.generate_build_files()
+        self.assertEqual(len(result.inputs), 5)
+
+        output = manager.expected_build_output_files()
+        self.assertEqual(result.created, output)
+        self.assertEqual(len(result.updated), 0)
+        self.assertEqual(len(result.unchanged), 0)
+
+        for f in output:
+            self.assertTrue(os.path.isfile(f))
+
+        for f in manager.GLOBAL_DECLARE_FILES:
+            self.assertIn(mozpath.join(manager._exported_header_dir, f), output)
+
+        for f in manager.GLOBAL_DEFINE_FILES:
+            self.assertIn(mozpath.join(manager._codegen_dir, f), output)
+
+        for s in self.TEST_STEMS:
+            self.assertTrue(os.path.isfile(mozpath.join(
+                manager._exported_header_dir, '%sBinding.h' % s)))
+            self.assertTrue(os.path.isfile(mozpath.join(
+                manager._codegen_dir, '%sBinding.cpp' % s)))
+
+        self.assertTrue(os.path.isfile(manager._state_path))
+
+        with open(manager._state_path, 'rb') as fh:
+            state = json.load(fh)
+            self.assertEqual(state['version'], 1)
+            self.assertIn('webidls', state)
+
+            child = state['webidls']['Child.webidl']
+            self.assertEqual(len(child['inputs']), 2)
+            self.assertEqual(len(child['outputs']), 2)
+            self.assertEqual(child['sha1'], 'c41527cad3bc161fa6e7909e48fa11f9eca0468b')
+
+    def test_generate_build_files_load_state(self):
+        """State should be equivalent when instantiating a new instance."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        self.assertEqual(len(m1._state['webidls']), 0)
+        m1.generate_build_files()
+
+        m2 = WebIDLCodegenManager(**args)
+        self.assertGreater(len(m2._state['webidls']), 2)
+        self.assertEqual(m1._state, m2._state)
+
+    def test_no_change_no_writes(self):
+        """If nothing changes, no files should be updated."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        m2 = WebIDLCodegenManager(**args)
+        result = m2.generate_build_files()
+
+        self.assertEqual(len(result.inputs), 0)
+        self.assertEqual(len(result.created), 0)
+        self.assertEqual(len(result.updated), 0)
+
+    def test_output_file_regenerated(self):
+        """If an output file disappears, it is regenerated."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        rm_count = 0
+        for p in m1._state['webidls']['Child.webidl']['outputs']:
+            rm_count += 1
+            os.unlink(p)
+
+        for p in m1.GLOBAL_DECLARE_FILES:
+            rm_count += 1
+            os.unlink(mozpath.join(m1._exported_header_dir, p))
+
+        m2 = WebIDLCodegenManager(**args)
+        result = m2.generate_build_files()
+        self.assertEqual(len(result.created), rm_count)
+
+    def test_only_rebuild_self(self):
+        """If an input file changes, only rebuild that one file."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        child_path = None
+        for p in m1._input_paths:
+            if p.endswith('Child.webidl'):
+                child_path = p
+                break
+
+        self.assertIsNotNone(child_path)
+        child_content = open(child_path, 'rb').read()
+
+        with MockedOpen({child_path: child_content + '\n/* */'}):
+            m2 = WebIDLCodegenManager(**args)
+            result = m2.generate_build_files()
+            self.assertEqual(result.inputs, set([child_path]))
+            self.assertEqual(len(result.updated), 0)
+            self.assertEqual(len(result.created), 0)
+
+    def test_rebuild_dependencies(self):
+        """Ensure an input file used by others results in others rebuilding."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        parent_path = None
+        child_path = None
+        for p in m1._input_paths:
+            if p.endswith('Parent.webidl'):
+                parent_path = p
+            elif p.endswith('Child.webidl'):
+                child_path = p
+
+        self.assertIsNotNone(parent_path)
+        parent_content = open(parent_path, 'rb').read()
+
+        with MockedOpen({parent_path: parent_content + '\n/* */'}):
+            m2 = WebIDLCodegenManager(**args)
+            result = m2.generate_build_files()
+            self.assertEqual(result.inputs, {child_path, parent_path})
+            self.assertEqual(len(result.updated), 0)
+            self.assertEqual(len(result.created), 0)
+
+    def test_python_change_regenerate_everything(self):
+        """If a Python file changes, we should attempt to rebuild everything."""
+
+        # We don't want to mutate files in the source directory because we want
+        # to be able to build from a read-only filesystem. So, we install a
+        # dummy module and rewrite the metadata to say it comes from the source
+        # directory.
+        #
+        # Hacking imp to accept a MockedFile doesn't appear possible. So for
+        # the first iteration we read from a temp file. The second iteration
+        # doesn't need to import, so we are fine with a mocked file.
+        fake_path = mozpath.join(OUR_DIR, 'fakemodule.py')
+        with NamedTemporaryFile('wt') as fh:
+            fh.write('# Original content')
+            fh.flush()
+            mod = imp.load_source('mozwebidlcodegen.fakemodule', fh.name)
+            mod.__file__ = fake_path
+
+            args = self._get_manager_args()
+            m1 = WebIDLCodegenManager(**args)
+            with MockedOpen({fake_path: '# Original content'}):
+                old_exists = os.path.exists
+                try:
+                    def exists(p):
+                        if p == fake_path:
+                            return True
+                        return old_exists(p)
+
+                    os.path.exists = exists
+
+                    result = m1.generate_build_files()
+                    l = len(result.inputs)
+
+                    with open(fake_path, 'wt') as fh:
+                        fh.write('# Modified content')
+
+                    m2 = WebIDLCodegenManager(**args)
+                    result = m2.generate_build_files()
+                    self.assertEqual(len(result.inputs), l)
+
+                    result = m2.generate_build_files()
+                    self.assertEqual(len(result.inputs), 0)
+                finally:
+                    os.path.exists = old_exists
+                    del sys.modules['mozwebidlcodegen.fakemodule']
+
+
+if __name__ == '__main__':
+    main()

From b47eeb6ab324dc64044dd09bb8b44abac4198ba0 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Thu, 12 Dec 2013 16:26:38 +0900
Subject: [PATCH 002/144] Bug 928195 - Part 4: Rewrite WebIDL build system
 integration; r=bz, r=glandium

WebIDL build system integration has been rewritten from the ground up.
Changes:

* GlobalGen.py, BindingGen.py, and ExampleGen.py have been removed in
  favor of mozwebidl.py.

* Static .webidl files are now processed directly in their original location
  and aren't copied to the object directory.

* Generated events <stem>.cpp files are now compiled into the unified
  sources. Previously, only the <stem>Binding.cpp files were compiled
  into unified sources.

* Exported .h files are now generated directly into their final location.
  Previously, they were generated into the local directory then
  installed in their final location.

* The list of globalgen-generated files now lives in Python and isn't
  duplicated in 3 places.

* The make dependencies are much simpler as a result of using a single
  command to perform all code generation. The auto-generated .pp file from
  code generation sets up all dependencies necessary to reinvoke code
  generation and Python takes care of dependency management.

--HG--
extra : rebase_source : e4918878274b22a412329c7cb18cc7138daf5dc6
---
 CLOBBER                                       |   7 +-
 dom/bindings/BindingGen.py                    |  98 -------
 dom/bindings/Codegen.py                       |  21 --
 dom/bindings/ExampleGen.py                    |  46 ---
 dom/bindings/GlobalGen.py                     |  81 -----
 dom/bindings/Makefile.in                      | 276 ++++--------------
 dom/bindings/moz.build                        |   2 +
 dom/bindings/mozwebidlcodegen/__init__.py     |  42 +++
 dom/bindings/test/Makefile.in                 |  80 +----
 dom/bindings/test/moz.build                   |  13 +-
 dom/moz.build                                 |   3 -
 dom/webidl/moz.build                          |  12 -
 python/mozbuild/mozbuild/action/webidl.py     |  17 ++
 python/mozbuild/mozbuild/backend/common.py    | 108 ++++++-
 .../mozbuild/backend/recursivemake.py         | 179 ++++++------
 python/mozbuild/mozbuild/base.py              |   4 +
 16 files changed, 351 insertions(+), 638 deletions(-)
 delete mode 100644 dom/bindings/BindingGen.py
 delete mode 100644 dom/bindings/ExampleGen.py
 delete mode 100644 dom/bindings/GlobalGen.py
 create mode 100644 python/mozbuild/mozbuild/action/webidl.py

diff --git a/CLOBBER b/CLOBBER
index 91acfa9390b2..f61ddd42af5e 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -18,4 +18,9 @@
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
-Bug 887836 - webidl changes require a Windows clobber.
+# Are you updating CLOBBER because you think it's needed for your WebIDL
+# changes to stick? As of bug 928195, this shouldn't be necessary! Please
+# don't change CLOBBER for WebIDL changes any more.
+Bug 928195 rewrote WebIDL build system integration from the ground up. This
+will hopefully be the last required clobber due to WebIDLs poorly interacting
+with the build system.
diff --git a/dom/bindings/BindingGen.py b/dom/bindings/BindingGen.py
deleted file mode 100644
index e064270513f5..000000000000
--- a/dom/bindings/BindingGen.py
+++ /dev/null
@@ -1,98 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-import os
-import cPickle
-from Configuration import Configuration
-from Codegen import CGBindingRoot, replaceFileIfChanged, CGEventRoot
-from mozbuild.makeutil import Makefile
-from mozbuild.pythonutil import iter_modules_in_path
-from buildconfig import topsrcdir
-
-
-def generate_binding_files(config, outputprefix, srcprefix, webidlfile,
-                           generatedEventsWebIDLFiles):
-    """
-    |config| Is the configuration object.
-    |outputprefix| is a prefix to use for the header guards and filename.
-    """
-
-    depsname = ".deps/" + outputprefix + ".pp"
-    root = CGBindingRoot(config, outputprefix, webidlfile)
-    replaceFileIfChanged(outputprefix + ".h", root.declare())
-    replaceFileIfChanged(outputprefix + ".cpp", root.define())
-
-    if webidlfile in generatedEventsWebIDLFiles:
-        eventName = webidlfile[:-len(".webidl")]
-        generatedEvent = CGEventRoot(config, eventName)
-        replaceFileIfChanged(eventName + ".h", generatedEvent.declare())
-        replaceFileIfChanged(eventName + ".cpp", generatedEvent.define())
-
-    mk = Makefile()
-    # NOTE: it's VERY important that we output dependencies for the FooBinding
-    # file here, not for the header or generated cpp file.  These dependencies
-    # are used later to properly determine changedDeps and prevent rebuilding
-    # too much.  See the comment explaining $(binding_dependency_trackers) in
-    # Makefile.in.
-    rule = mk.create_rule([outputprefix])
-    rule.add_dependencies(os.path.join(srcprefix, x) for x in sorted(root.deps()))
-    rule.add_dependencies(iter_modules_in_path(topsrcdir))
-    with open(depsname, 'w') as f:
-        mk.dump(f)
-
-def main():
-    # Parse arguments.
-    from optparse import OptionParser
-    usagestring = "usage: %prog [header|cpp] configFile outputPrefix srcPrefix webIDLFile"
-    o = OptionParser(usage=usagestring)
-    o.add_option("--verbose-errors", action='store_true', default=False,
-                 help="When an error happens, display the Python traceback.")
-    (options, args) = o.parse_args()
-
-    configFile = os.path.normpath(args[0])
-    srcPrefix = os.path.normpath(args[1])
-
-    # Load the configuration
-    f = open('ParserResults.pkl', 'rb')
-    config = cPickle.load(f)
-    f.close()
-
-    def readFile(f):
-        file = open(f, 'rb')
-        try:
-            contents = file.read()
-        finally:
-            file.close()
-        return contents
-    allWebIDLFiles = readFile(args[2]).split()
-    generatedEventsWebIDLFiles = readFile(args[3]).split()
-    changedDeps = readFile(args[4]).split()
-
-    if all(f.endswith("Binding") or f == "ParserResults.pkl" for f in changedDeps):
-        toRegenerate = filter(lambda f: f.endswith("Binding"), changedDeps)
-        if len(toRegenerate) == 0 and len(changedDeps) == 1:
-            # Work around build system bug 874923: if we get here that means
-            # that changedDeps contained only one entry and it was
-            # "ParserResults.pkl".  That should never happen: if the
-            # ParserResults.pkl changes then either one of the globalgen files
-            # changed (in which case we wouldn't be in this "only
-            # ParserResults.pkl and *Binding changed" code) or some .webidl
-            # files changed (and then the corresponding *Binding files should
-            # show up in changedDeps).  Since clearly the build system is
-            # confused, just regenerate everything to be safe.
-            toRegenerate = allWebIDLFiles
-        else:
-            toRegenerate = map(lambda f: f[:-len("Binding")] + ".webidl",
-                               toRegenerate)
-    else:
-        toRegenerate = allWebIDLFiles
-
-    for webIDLFile in toRegenerate:
-        assert webIDLFile.endswith(".webidl")
-        outputPrefix = webIDLFile[:-len(".webidl")] + "Binding"
-        generate_binding_files(config, outputPrefix, srcPrefix, webIDLFile,
-                               generatedEventsWebIDLFiles);
-
-if __name__ == '__main__':
-    main()
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index c32b821fa513..97272e5a1b22 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -29,27 +29,6 @@ INSTANCE_RESERVED_SLOTS = 3
 def memberReservedSlot(member):
     return "(DOM_INSTANCE_RESERVED_SLOTS + %d)" % member.slotIndex
 
-def replaceFileIfChanged(filename, newContents):
-    """
-    Read a copy of the old file, so that we don't touch it if it hasn't changed.
-    Returns True if the file was updated, false otherwise.
-    """
-    oldFileContents = ""
-    try:
-        oldFile = open(filename, 'rb')
-        oldFileContents = ''.join(oldFile.readlines())
-        oldFile.close()
-    except:
-        pass
-
-    if newContents == oldFileContents:
-        return False
-
-    f = open(filename, 'wb')
-    f.write(newContents)
-    f.close()
-    return True
-
 def toStringBool(arg):
     return str(not not arg).lower()
 
diff --git a/dom/bindings/ExampleGen.py b/dom/bindings/ExampleGen.py
deleted file mode 100644
index 60eebe221a38..000000000000
--- a/dom/bindings/ExampleGen.py
+++ /dev/null
@@ -1,46 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-import os
-import cPickle
-from Configuration import Configuration
-from Codegen import CGExampleRoot, replaceFileIfChanged
-
-def generate_interface_example(config, interfaceName):
-    """
-    |config| Is the configuration object.
-    |interfaceName| is the name of the interface we're generating an example for.
-    """
-
-    root = CGExampleRoot(config, interfaceName)
-    exampleHeader = interfaceName + "-example.h"
-    exampleImpl = interfaceName + "-example.cpp"
-    replaceFileIfChanged(exampleHeader, root.declare())
-    replaceFileIfChanged(exampleImpl, root.define())
-
-def main():
-
-    # Parse arguments.
-    from optparse import OptionParser
-    usagestring = "usage: %prog configFile interfaceName"
-    o = OptionParser(usage=usagestring)
-    o.add_option("--verbose-errors", action='store_true', default=False,
-                 help="When an error happens, display the Python traceback.")
-    (options, args) = o.parse_args()
-
-    if len(args) != 2:
-        o.error(usagestring)
-    configFile = os.path.normpath(args[0])
-    interfaceName = args[1]
-
-    # Load the configuration
-    f = open('ParserResults.pkl', 'rb')
-    config = cPickle.load(f)
-    f.close()
-
-    # Generate the example class.
-    generate_interface_example(config, interfaceName)
-
-if __name__ == '__main__':
-    main()
diff --git a/dom/bindings/GlobalGen.py b/dom/bindings/GlobalGen.py
deleted file mode 100644
index f3f02a4d1e48..000000000000
--- a/dom/bindings/GlobalGen.py
+++ /dev/null
@@ -1,81 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# We do one global pass over all the WebIDL to generate our prototype enum
-# and generate information for subsequent phases.
-
-import os
-import WebIDL
-import cPickle
-from Configuration import Configuration
-from Codegen import GlobalGenRoots, replaceFileIfChanged
-
-def generate_file(config, name, action):
-
-    root = getattr(GlobalGenRoots, name)(config)
-    if action is 'declare':
-        filename = name + '.h'
-        code = root.declare()
-    else:
-        assert action is 'define'
-        filename = name + '.cpp'
-        code = root.define()
-
-    if replaceFileIfChanged(filename, code):
-        print "Generating %s" % (filename)
-    else:
-        print "%s hasn't changed - not touching it" % (filename)
-
-def main():
-    # Parse arguments.
-    from optparse import OptionParser
-    usageString = "usage: %prog [options] webidldir [files]"
-    o = OptionParser(usage=usageString)
-    o.add_option("--cachedir", dest='cachedir', default=None,
-                 help="Directory in which to cache lex/parse tables.")
-    o.add_option("--verbose-errors", action='store_true', default=False,
-                 help="When an error happens, display the Python traceback.")
-    (options, args) = o.parse_args()
-
-    if len(args) < 2:
-        o.error(usageString)
-
-    configFile = args[0]
-    baseDir = args[1]
-    fileList = args[2:]
-
-    # Parse the WebIDL.
-    parser = WebIDL.Parser(options.cachedir)
-    for filename in fileList:
-        fullPath = os.path.normpath(os.path.join(baseDir, filename))
-        f = open(fullPath, 'rb')
-        lines = f.readlines()
-        f.close()
-        parser.parse(''.join(lines), fullPath)
-    parserResults = parser.finish()
-
-    # Load the configuration.
-    config = Configuration(configFile, parserResults)
-
-    # Write the configuration out to a pickle.
-    resultsFile = open('ParserResults.pkl', 'wb')
-    cPickle.dump(config, resultsFile, -1)
-    resultsFile.close()
-
-    # Generate the atom list.
-    generate_file(config, 'GeneratedAtomList', 'declare')
-
-    # Generate the prototype list.
-    generate_file(config, 'PrototypeList', 'declare')
-
-    # Generate the common code.
-    generate_file(config, 'RegisterBindings', 'declare')
-    generate_file(config, 'RegisterBindings', 'define')
-
-    generate_file(config, 'UnionTypes', 'declare')
-    generate_file(config, 'UnionTypes', 'define')
-    generate_file(config, 'UnionConversions', 'declare')
-
-if __name__ == '__main__':
-    main()
diff --git a/dom/bindings/Makefile.in b/dom/bindings/Makefile.in
index a4a029ae5964..418a39837eec 100644
--- a/dom/bindings/Makefile.in
+++ b/dom/bindings/Makefile.in
@@ -1,245 +1,85 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+abs_dist := $(abspath $(DIST))
+webidl_base := $(topsrcdir)/dom/webidl
 
-webidl_base = $(topsrcdir)/dom/webidl
 # Generated by moz.build
 include webidlsrcs.mk
 
-binding_include_path := mozilla/dom
-webidl_files += $(generated_events_webidl_files)
-all_webidl_files = $(webidl_files) $(generated_webidl_files) $(preprocessed_webidl_files)
-
-# Set exported_binding_headers before adding the test IDL to the mix
-exported_binding_headers := $(subst .webidl,Binding.h,$(all_webidl_files))
-exported_generated_events_headers := $(subst .webidl,.h,$(generated_events_webidl_files))
-
-# Set linked_binding_cpp_files before adding the test IDL to the mix
-linked_binding_cpp_files := $(subst .webidl,Binding.cpp,$(all_webidl_files))
-linked_generated_events_cpp_files := $(subst .webidl,.cpp,$(generated_events_webidl_files))
-
-all_webidl_files += $(test_webidl_files) $(preprocessed_test_webidl_files)
-
-generated_header_files := $(subst .webidl,Binding.h,$(all_webidl_files)) $(exported_generated_events_headers)
-generated_cpp_files := $(subst .webidl,Binding.cpp,$(all_webidl_files)) $(linked_generated_events_cpp_files)
-
-# We want to be able to only regenerate the .cpp and .h files that really need
-# to change when a .webidl file changes.  We do this by making the
-# binding_dependency_trackers targets have dependencies on the right .webidl
-# files via generated .pp files, having a .BindingGen target that depends on the
-# binding_dependency_trackers and which has all the generated binding .h/.cpp
-# depending on it, and then in the make commands for that target being able to
-# check which exact binding_dependency_trackers changed.
-binding_dependency_trackers := $(subst .webidl,Binding,$(all_webidl_files))
-
-globalgen_targets := \
-  GeneratedAtomList.h \
-  PrototypeList.h \
-  RegisterBindings.h \
-  RegisterBindings.cpp \
-  UnionTypes.h \
-  UnionTypes.cpp \
-  UnionConversions.h \
-  $(NULL)
-
-# Nasty hack: when the test/Makefile.in invokes us to do codegen, it
-# uses a target of
-# "export TestExampleInterface-example TestExampleProxyInterface-example".
-# We don't actually need to load our .o.pp files in that case, so just
-# pretend like we have no CPPSRCS if that's the target.  It makes the
-# test cycle much faster, which is why we're doing it.
-#
-# XXXbz We could try to cheat even more and only include our CPPSRCS
-# when $(MAKECMDGOALS) contains libs, so that we can skip loading all
-# those .o.pp when trying to make a single .cpp file too, but that
-# would break |make FooBinding.o(bj)|.  Ah, well.
-ifneq (export TestExampleInterface-example TestExampleProxyInterface-example,$(MAKECMDGOALS))
-CPPSRCS = \
-  $(unified_binding_cpp_files) \
-  $(linked_generated_events_cpp_files) \
-  $(filter %.cpp, $(globalgen_targets)) \
-  $(NULL)
+ifdef GNU_CC
+OS_CXXFLAGS += -Wno-uninitialized
 endif
 
-ABS_DIST := $(abspath $(DIST))
+# These come from webidlsrcs.mk.
+# TODO Write directly into backend.mk.
+CPPSRCS += $(globalgen_sources) $(unified_binding_cpp_files)
 
-EXTRA_EXPORT_MDDEPEND_FILES := $(addsuffix .pp,$(binding_dependency_trackers))
-
-EXPORTS_GENERATED_FILES := $(exported_binding_headers) $(exported_generated_events_headers)
-EXPORTS_GENERATED_DEST := $(ABS_DIST)/include/$(binding_include_path)
-EXPORTS_GENERATED_TARGET := export
-INSTALL_TARGETS += EXPORTS_GENERATED
-
-# Install auto-generated GlobalGen files. The rules for the install must
-# be in the same target/subtier as GlobalGen.py, otherwise the files will not
-# get installed into the appropriate location as they are generated.
-globalgen_headers_FILES := \
-  GeneratedAtomList.h \
-  PrototypeList.h \
-  RegisterBindings.h \
-  UnionConversions.h \
-  UnionTypes.h \
-  $(NULL)
-globalgen_headers_DEST = $(ABS_DIST)/include/mozilla/dom
-globalgen_headers_TARGET := export
-INSTALL_TARGETS += globalgen_headers
+# Generated bindings reference *Binding.h, not mozilla/dom/*Binding.h. And,
+# since we generate exported bindings directly to $(DIST)/include, we need
+# to add that path to the search list.
+#
+# Ideally, binding generation uses the prefixed header file names.
+# Bug 932092 tracks.
+LOCAL_INCLUDES += -I$(DIST)/include/mozilla/dom
 
 PYTHON_UNIT_TESTS += $(srcdir)/mozwebidlcodegen/test/test_mozwebidlcodegen.py
 
 include $(topsrcdir)/config/rules.mk
 
-ifdef GNU_CC
-CXXFLAGS += -Wno-uninitialized
-endif
-
-# If you change bindinggen_dependencies here, change it in
-# dom/bindings/test/Makefile.in too.
-bindinggen_dependencies := \
-  BindingGen.py \
-  Bindings.conf \
-  Configuration.py \
-  Codegen.py \
-  ParserResults.pkl \
-  parser/WebIDL.py \
+# TODO This list should be emitted to a .pp file via
+# GenerateCSS2PropertiesWebIDL.py.
+css2properties_dependencies = \
+  $(topsrcdir)/layout/style/nsCSSPropList.h \
+  $(topsrcdir)/layout/style/nsCSSPropAliasList.h \
+  $(webidl_base)/CSS2Properties.webidl.in \
+  $(webidl_base)/CSS2PropertiesProps.h \
+  $(srcdir)/GenerateCSS2PropertiesWebIDL.py \
   $(GLOBAL_DEPS) \
   $(NULL)
 
-CSS2Properties.webidl: $(topsrcdir)/layout/style/nsCSSPropList.h \
-                       $(topsrcdir)/layout/style/nsCSSPropAliasList.h \
-                       $(webidl_base)/CSS2Properties.webidl.in \
-                       $(webidl_base)/CSS2PropertiesProps.h \
-                       $(srcdir)/GenerateCSS2PropertiesWebIDL.py \
-                       $(GLOBAL_DEPS)
-	$(CPP) $(DEFINES) $(ACDEFINES) -I$(topsrcdir)/layout/style $(webidl_base)/CSS2PropertiesProps.h | \
-	  PYTHONDONTWRITEBYTECODE=1 $(PYTHON) \
-	  $(srcdir)/GenerateCSS2PropertiesWebIDL.py $(webidl_base)/CSS2Properties.webidl.in > CSS2Properties.webidl
+CSS2Properties.webidl: $(css2properties_dependencies)
+	$(CPP) $(DEFINES) $(ACDEFINES) -I$(topsrcdir)/layout/style \
+	  $(webidl_base)/CSS2PropertiesProps.h | \
+	    PYTHONDONTWRITEBYTECODE=1 $(PYTHON) \
+	      $(srcdir)/GenerateCSS2PropertiesWebIDL.py \
+	      $(webidl_base)/CSS2Properties.webidl.in > $@
 
-$(webidl_files): %: $(webidl_base)/%
-	$(INSTALL) $(IFLAGS1) $(webidl_base)/$* .
-
-$(test_webidl_files): %: $(srcdir)/test/%
-	$(INSTALL) $(IFLAGS1) $(srcdir)/test/$* .
-
-# We can't easily use PP_TARGETS here because it insists on outputting targets
-# that look like "$(CURDIR)/foo" whereas we want our target to just be "foo".
-# Make sure to include $(GLOBAL_DEPS) so we pick up changes to what symbols are
-# defined.  Also make sure to remove $@ before writing to it, because otherwise
-# if a file goes from non-preprocessed to preprocessed we can end up writing to
-# a symlink, which will clobber files in the srcdir, which is bad.
-$(preprocessed_webidl_files): %: $(webidl_base)/% $(GLOBAL_DEPS)
-	$(RM) $@
-	$(call py_action,preprocessor, \
-          $(DEFINES) $(ACDEFINES) $(XULPPFLAGS) $(webidl_base)/$* -o $@)
-
-# See the comment about PP_TARGETS for $(preprocessed_webidl_files)
-$(preprocessed_test_webidl_files): %: $(srcdir)/test/% $(GLOBAL_DEPS)
-	$(RM) $@
-	$(call py_action,preprocessor, \
-          $(DEFINES) $(ACDEFINES) $(XULPPFLAGS) $(srcdir)/test/$* -o $@)
-
-# Make is dumb and can get confused between "foo" and "$(CURDIR)/foo".  Make
-# sure that the latter depends on the former, since the latter gets used in .pp
-# files.
-all_webidl_files_absolute = $(addprefix $(CURDIR)/,$(all_webidl_files))
-$(all_webidl_files_absolute): $(CURDIR)/%: %
-
-$(generated_header_files): .BindingGen
-
-$(generated_cpp_files): .BindingGen
-
-# $(binding_dependency_trackers) pick up additional dependencies via .pp files
-# The rule: just brings the tracker up to date, if it's out of date, so that
-# we'll know that we have to redo binding generation and flag this prerequisite
-# there as being newer than the bindinggen target.
-$(binding_dependency_trackers):
-	@$(TOUCH) $@
-
-$(globalgen_targets): ParserResults.pkl
-
-%-example: .BindingGen
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
-	  $(PLY_INCLUDE) -I$(srcdir)/parser \
-	  $(srcdir)/ExampleGen.py \
-	  $(srcdir)/Bindings.conf $*
-
-CACHE_DIR = _cache
-
-globalgen_dependencies := \
-  GlobalGen.py \
-  Bindings.conf \
-  Configuration.py \
-  Codegen.py \
-  parser/WebIDL.py \
-  webidlsrcs.mk \
-  $(all_webidl_files) \
-  $(CACHE_DIR)/.done \
+# Most of the logic for dependencies lives inside Python so it can be
+# used by multiple build backends. We simply have rules to generate
+# and include the .pp file.
+#
+# The generated .pp file contains all the important dependencies such as
+# changes to .webidl or .py files should result in code generation being
+# performed.
+codegen_dependencies := \
+  $(nonstatic_webidl_files) \
   $(GLOBAL_DEPS) \
   $(NULL)
 
-$(CACHE_DIR)/.done:
-	$(MKDIR) -p $(CACHE_DIR)
+$(call include_deps,codegen.pp)
+
+codegen.pp: $(codegen_dependencies)
+	$(call py_action,webidl,$(srcdir))
 	@$(TOUCH) $@
 
-# Running GlobalGen.py updates ParserResults.pkl as a side-effect
-ParserResults.pkl: $(globalgen_dependencies)
-	$(info Generating global WebIDL files)
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
-	  $(PLY_INCLUDE) -I$(srcdir)/parser \
-	  $(srcdir)/GlobalGen.py $(srcdir)/Bindings.conf . \
-	  --cachedir=$(CACHE_DIR) \
-	  $(all_webidl_files)
-
-$(globalgen_headers_FILES): ParserResults.pkl
-
-# Make sure .deps actually exists, since we'll try to write to it from
-# BindingGen.py but we're typically running in the export phase, which is
-# before anyone has bothered creating .deps.
-# Then, pass our long lists through files to try to avoid blowing out the
-# command line.
-# Next, BindingGen.py will examine the changed dependency list to figure out
-# what it really needs to regenerate.
-# Finally, touch the .BindingGen file so that we don't have to keep redoing
-# all that until something else actually changes.
-.BindingGen: $(bindinggen_dependencies) $(binding_dependency_trackers)
-	$(info Generating WebIDL bindings)
-	$(MKDIR) -p .deps
-	echo $(all_webidl_files) > .all-webidl-file-list
-	echo $(generated_events_webidl_files) > .generated-events-webidl-files
-	echo $? > .changed-dependency-list
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
-	  $(PLY_INCLUDE) -I$(srcdir)/parser \
-	  $(srcdir)/BindingGen.py \
-	  $(srcdir)/Bindings.conf \
-	  $(CURDIR) \
-	  .all-webidl-file-list \
-	  .generated-events-webidl-files \
-	  .changed-dependency-list
-	@$(TOUCH) $@
+.PHONY: compiletests
+compiletests:
+	$(call SUBMAKE,libs,test)
 
 GARBAGE += \
-  webidlyacc.py \
+  codegen.pp \
+  codegen.json \
   parser.out \
-  $(wildcard *-example.h) \
-  $(wildcard *-example.cpp) \
-  .BindingGen \
-  .all-webidl-file-list \
-  .generated-events-webidl-files \
-  .changed-dependency-list \
-  $(binding_dependency_trackers) \
+  WebIDLGrammar.pkl \
+  $(wildcard *.h) \
+  $(wildcard *Binding.cpp) \
+  $(wildcard *Event.cpp) \
+  $(wildcard *-event.cpp) \
+  $(wildcard *.webidl) \
   $(NULL)
 
-# Make sure all binding header files are created during the export stage, so we
-# don't have issues with .cpp files being compiled before we've generated the
-# headers they depend on.  This is really only needed for the test files, since
-# the non-test headers are all exported above anyway.  Note that this means that
-# we do all of our codegen during export.
-export:: $(generated_header_files)
-
-distclean::
-	-$(RM) \
-        $(generated_header_files) \
-        $(generated_cpp_files) \
-        $(all_webidl_files) \
-        $(globalgen_targets) \
-        ParserResults.pkl \
-        $(NULL)
+DIST_GARBAGE += \
+  file-lists.json \
+  $(NULL)
diff --git a/dom/bindings/moz.build b/dom/bindings/moz.build
index bd46aa837b75..557d4a63e92f 100644
--- a/dom/bindings/moz.build
+++ b/dom/bindings/moz.build
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+TEST_DIRS += ['test']
+
 EXPORTS.mozilla += [
     'ErrorResult.h',
 ]
diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index 4fc5d3bbd046..5516dbb3a1a0 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -17,6 +17,7 @@ from copy import deepcopy
 
 from mach.mixin.logging import LoggingMixin
 
+from mozbuild.base import MozbuildObject
 from mozbuild.makeutil import Makefile
 from mozbuild.pythonutil import iter_modules_in_path
 from mozbuild.util import FileAvoidWrite
@@ -521,3 +522,44 @@ class WebIDLCodegenManager(LoggingMixin):
             result[1].add(path)
         else:
             result[2].add(path)
+
+
+def create_build_system_manager(topsrcdir, topobjdir, dist_dir):
+    """Create a WebIDLCodegenManager for use by the build system."""
+    src_dir = os.path.join(topsrcdir, 'dom', 'bindings')
+    obj_dir = os.path.join(topobjdir, 'dom', 'bindings')
+
+    with open(os.path.join(obj_dir, 'file-lists.json'), 'rb') as fh:
+        files = json.load(fh)
+
+    inputs = (files['webidls'], files['exported_stems'],
+        files['generated_events_stems'])
+
+    cache_dir = os.path.join(obj_dir, '_cache')
+    try:
+        os.makedirs(cache_dir)
+    except OSError as e:
+        if e.errno != errno.EEXIST:
+            raise
+
+    return WebIDLCodegenManager(
+        os.path.join(src_dir, 'Bindings.conf'),
+        inputs,
+        os.path.join(dist_dir, 'include', 'mozilla', 'dom'),
+        obj_dir,
+        os.path.join(obj_dir, 'codegen.json'),
+        cache_dir=cache_dir,
+        # The make rules include a codegen.pp file containing dependencies.
+        make_deps_path=os.path.join(obj_dir, 'codegen.pp'),
+        make_deps_target='codegen.pp',
+    )
+
+
+class BuildSystemWebIDL(MozbuildObject):
+    @property
+    def manager(self):
+        if not hasattr(self, '_webidl_manager'):
+            self._webidl_manager = create_build_system_manager(
+                self.topsrcdir, self.topobjdir, self.distdir)
+
+        return self._webidl_manager
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index 78756bf35a03..78a3cafd020c 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -2,89 +2,23 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# Do NOT export this library.  We don't actually want our test code
-# being added to libxul or anything.
-
-# pymake can't handle descending into dom/bindings several times simultaneously
-ifdef .PYMAKE
-.NOTPARALLEL:
-endif
-
-# Need this for $(test_webidl_files)
 include ../webidlsrcs.mk
 
-# But the webidl actually lives in our parent dir
-test_webidl_files := $(addprefix ../,$(test_webidl_files))
-# Store the actual locations of our source preprocessed files, so we
-# can depend on them sanely.
-source_preprocessed_test_webidl_files := $(addprefix $(srcdir)/,$(preprocessed_test_webidl_files))
-preprocessed_test_webidl_files := $(addprefix ../,$(preprocessed_test_webidl_files))
-
-CPPSRCS += \
-  $(subst .webidl,Binding.cpp,$(test_webidl_files)) \
-  $(subst .webidl,Binding.cpp,$(preprocessed_test_webidl_files)) \
-  $(NULL)
-
-# If you change bindinggen_dependencies here, change it in
-# dom/bindings/Makefile.in too.  But note that we include ../Makefile
-# here manually, since $(GLOBAL_DEPS) won't cover it.
-bindinggen_dependencies := \
-  ../BindingGen.py \
-  ../Bindings.conf \
-  ../Configuration.py \
-  ../Codegen.py \
-  ../ParserResults.pkl \
-  ../parser/WebIDL.py \
-  ../Makefile \
-  $(GLOBAL_DEPS) \
-  $(NULL)
+# $(test_sources) comes from webidlsrcs.mk.
+# TODO Update this variable in backend.mk.
+CPPSRCS += $(addprefix ../,$(test_sources))
 
 ifdef GNU_CC
-CXXFLAGS += -Wno-uninitialized
+OS_CXXFLAGS += -Wno-uninitialized
 endif
 
+# Bug 932082 tracks having bindings use namespaced includes.
+LOCAL_INCLUDES += -I$(DIST)/include/mozilla/dom -I..
+
 # Include rules.mk before any of our targets so our first target is coming from
 # rules.mk and running make with no target in this dir does the right thing.
 include $(topsrcdir)/config/rules.mk
 
-$(CPPSRCS): .BindingGen
-
-.BindingGen: $(bindinggen_dependencies) \
-             $(test_webidl_files) \
-             $(source_preprocessed_test_webidl_files) \
-             $(NULL)
-	# The export phase in dom/bindings is what actually looks at
-	# dependencies and regenerates things as needed, so just go ahead and
-	# make that phase here.  Also make our example interface files.  If the
-	# target used here ever changes, change the conditional around
-	# $(CPPSRCS) in dom/bindings/Makefile.in.
-	$(MAKE) -C .. export TestExampleInterface-example TestExampleProxyInterface-example
-	@$(TOUCH) $@
-
 check::
 	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
 	  $(PLY_INCLUDE) $(srcdir)/../parser/runtests.py
-
-# Since we define MOCHITEST_FILES, config/makefiles/mochitest.mk goes ahead and
-# sets up a rule with libs:: in itm which makes our .DEFAULT_TARGET be "libs".
-# Then ruls.mk does |.DEFAULT_TARGET ?= default| which leaves it as "libs".  So
-# if we make without an explicit target in this directory, we try to make
-# "libs", but with a $(MAKECMDGOALS) of empty string.  And then rules.mk
-# helpfully does not include our *.o.pp files, since it includes them only if
-# filtering some stuff out from $(MAKECMDGOALS) leaves it nonempty.  The upshot
-# is that if some headers change and we run make in this dir without an explicit
-# target things don't get rebuilt.
-#
-# On the other hand, if we set .DEFAULT_TARGET to "default" explicitly here,
-# then rules.mk will reinvoke make with "export" and "libs" but this time hey
-# will be passed as explicit targets, show up in $(MAKECMDGOALS), and things
-# will work.  Do this at the end of our Makefile so the rest of the build system
-# does not get a chance to muck with it after we set it.
-.DEFAULT_GOAL := default
-
-# Make sure to add .BindingGen to GARBAGE so we'll rebuild our example
-# files if someone goes through and deletes GARBAGE all over, which
-# will delete example files from our parent dir.
-GARBAGE += \
-  .BindingGen \
-  $(NULL)
diff --git a/dom/bindings/test/moz.build b/dom/bindings/test/moz.build
index 82db3c691cbc..5b129eee9e20 100644
--- a/dom/bindings/test/moz.build
+++ b/dom/bindings/test/moz.build
@@ -14,9 +14,20 @@ MOCHITEST_MANIFESTS += ['mochitest.ini']
 
 MOCHITEST_CHROME_MANIFESTS += ['chrome.ini']
 
+TEST_WEBIDL_FILES += [
+    'TestDictionary.webidl',
+    'TestJSImplInheritanceGen.webidl',
+    'TestTypedef.webidl',
+]
+
+PREPROCESSED_TEST_WEBIDL_FILES += [
+    'TestCodeGen.webidl',
+    'TestExampleGen.webidl',
+    'TestJSImplGen.webidl',
+]
+
 LOCAL_INCLUDES += [
     '/dom/bindings',
     '/js/xpconnect/src',
     '/js/xpconnect/wrappers',
 ]
-
diff --git a/dom/moz.build b/dom/moz.build
index 09bf93c46ed5..60aa95f2991f 100644
--- a/dom/moz.build
+++ b/dom/moz.build
@@ -107,12 +107,9 @@ if CONFIG['MOZ_NFC']:
 if CONFIG['MOZ_B2G']:
     PARALLEL_DIRS += ['downloads']
 
-# bindings/test is here, because it needs to build after bindings/, and
-# we build subdirectories before ourselves.
 TEST_DIRS += [
     'tests',
     'imptests',
-    'bindings/test',
 ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'cocoa', 'windows', 'android', 'qt', 'os2'):
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 108b38a1b3ec..e3f970284f36 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -553,18 +553,6 @@ if CONFIG['MOZ_B2G_FM']:
         'FMRadio.webidl',
     ]
 
-if CONFIG['ENABLE_TESTS']:
-    TEST_WEBIDL_FILES += [
-        'TestDictionary.webidl',
-        'TestJSImplInheritanceGen.webidl',
-        'TestTypedef.webidl',
-    ]
-    PREPROCESSED_TEST_WEBIDL_FILES += [
-        'TestCodeGen.webidl',
-        'TestExampleGen.webidl',
-        'TestJSImplGen.webidl',
-    ]
-
 GENERATED_EVENTS_WEBIDL_FILES = [
     'BlobEvent.webidl',
     'CallGroupErrorEvent.webidl',
diff --git a/python/mozbuild/mozbuild/action/webidl.py b/python/mozbuild/mozbuild/action/webidl.py
new file mode 100644
index 000000000000..6702701228e5
--- /dev/null
+++ b/python/mozbuild/mozbuild/action/webidl.py
@@ -0,0 +1,17 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import sys
+
+from mozwebidlcodegen import BuildSystemWebIDL
+
+
+def main(argv):
+    """Perform WebIDL code generation required by the build system."""
+    manager = BuildSystemWebIDL.from_environment().manager
+    manager.generate_build_files()
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/python/mozbuild/mozbuild/backend/common.py b/python/mozbuild/mozbuild/backend/common.py
index eec09f7eecb8..0a6fe8ad4049 100644
--- a/python/mozbuild/mozbuild/backend/common.py
+++ b/python/mozbuild/mozbuild/backend/common.py
@@ -10,15 +10,19 @@ import re
 
 import mozpack.path as mozpath
 
-from mozbuild.preprocessor import Preprocessor
-
 from .base import BuildBackend
 
 from ..frontend.data import (
     ConfigFileSubstitution,
     HeaderFileSubstitution,
+    GeneratedEventWebIDLFile,
+    GeneratedWebIDLFile,
+    PreprocessedTestWebIDLFile,
+    PreprocessedWebIDLFile,
     TestManifest,
+    TestWebIDLFile,
     XPIDLFile,
+    WebIDLFile,
 )
 
 from ..util import DefaultOnReadDict
@@ -56,6 +60,79 @@ class XPIDLManager(object):
         self.modules.setdefault(entry['module'], set()).add(entry['root'])
 
 
+class WebIDLCollection(object):
+    """Collects WebIDL info referenced during the build."""
+
+    def __init__(self):
+        self.sources = set()
+        self.generated_sources = set()
+        self.generated_events_sources = set()
+        self.preprocessed_sources = set()
+        self.test_sources = set()
+        self.preprocessed_test_sources = set()
+
+    def all_regular_sources(self):
+        return self.sources | self.generated_sources | \
+            self.generated_events_sources | self.preprocessed_sources
+
+    def all_regular_basenames(self):
+        return [os.path.basename(source) for source in self.all_regular_sources()]
+
+    def all_regular_stems(self):
+        return [os.path.splitext(b)[0] for b in self.all_regular_basenames()]
+
+    def all_regular_bindinggen_stems(self):
+        for stem in self.all_regular_stems():
+            yield '%sBinding' % stem
+
+        for source in self.generated_events_sources:
+            yield os.path.splitext(os.path.basename(source))[0]
+
+    def all_regular_cpp_basenames(self):
+        for stem in self.all_regular_bindinggen_stems():
+            yield '%s.cpp' % stem
+
+    def all_test_sources(self):
+        return self.test_sources | self.preprocessed_test_sources
+
+    def all_test_basenames(self):
+        return [os.path.basename(source) for source in self.all_test_sources()]
+
+    def all_test_stems(self):
+        return [os.path.splitext(b)[0] for b in self.all_test_basenames()]
+
+    def all_test_cpp_basenames(self):
+        return ['%sBinding.cpp' % s for s in self.all_test_stems()]
+
+    def all_static_sources(self):
+        return self.sources | self.generated_events_sources | \
+            self.test_sources
+
+    def all_non_static_sources(self):
+        return self.generated_sources | self.all_preprocessed_sources()
+
+    def all_non_static_basenames(self):
+        return [os.path.basename(s) for s in self.all_non_static_sources()]
+
+    def all_preprocessed_sources(self):
+        return self.preprocessed_sources | self.preprocessed_test_sources
+
+    def all_sources(self):
+        return set(self.all_regular_sources()) | set(self.all_test_sources())
+
+    def all_basenames(self):
+        return [os.path.basename(source) for source in self.all_sources()]
+
+    def all_stems(self):
+        return [os.path.splitext(b)[0] for b in self.all_basenames()]
+
+    def generated_events_basenames(self):
+        return [os.path.basename(s) for s in self.generated_events_sources]
+
+    def generated_events_stems(self):
+        return [os.path.splitext(b)[0] for b in self.generated_events_basenames()]
+
+
 class TestManager(object):
     """Helps hold state related to tests."""
 
@@ -90,6 +167,7 @@ class CommonBackend(BuildBackend):
     def _init(self):
         self._idl_manager = XPIDLManager(self.environment)
         self._test_manager = TestManager(self.environment)
+        self._webidls = WebIDLCollection()
 
     def consume_object(self, obj):
         if isinstance(obj, TestManifest):
@@ -113,6 +191,30 @@ class CommonBackend(BuildBackend):
             self._create_config_header(obj)
             self.backend_input_files.add(obj.input_path)
 
+        # We should consider aggregating WebIDL types in emitter.py.
+        elif isinstance(obj, WebIDLFile):
+            self._webidls.sources.add(mozpath.join(obj.srcdir, obj.basename))
+
+        elif isinstance(obj, GeneratedEventWebIDLFile):
+            self._webidls.generated_events_sources.add(mozpath.join(
+                obj.srcdir, obj.basename))
+
+        elif isinstance(obj, TestWebIDLFile):
+            self._webidls.test_sources.add(mozpath.join(obj.srcdir,
+                obj.basename))
+
+        elif isinstance(obj, PreprocessedTestWebIDLFile):
+            self._webidls.preprocessed_test_sources.add(mozpath.join(
+                obj.srcdir, obj.basename))
+
+        elif isinstance(obj, GeneratedWebIDLFile):
+            self._webidls.generated_sources.add(mozpath.join(obj.srcdir,
+                obj.basename))
+
+        elif isinstance(obj, PreprocessedWebIDLFile):
+            self._webidls.preprocessed_sources.add(mozpath.join(
+                obj.srcdir, obj.basename))
+
         else:
             return
 
@@ -122,6 +224,8 @@ class CommonBackend(BuildBackend):
         if len(self._idl_manager.idls):
             self._handle_idl_manager(self._idl_manager)
 
+        self._handle_webidl_collection(self._webidls)
+
         # Write out a machine-readable file describing every test.
         path = mozpath.join(self.environment.topobjdir, 'all-tests.json')
         with self._write_file(path) as fh:
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 3742ad4f340b..c9a4000dd46a 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -5,13 +5,15 @@
 from __future__ import unicode_literals
 
 import itertools
+import json
 import logging
 import os
-import re
 import types
 
 from collections import namedtuple
 
+import mozwebidlcodegen
+
 import mozbuild.makeutil as mozmakeutil
 from mozpack.copier import FilePurger
 from mozpack.manifests import (
@@ -25,9 +27,7 @@ from ..frontend.data import (
     Defines,
     DirectoryTraversal,
     Exports,
-    GeneratedEventWebIDLFile,
     GeneratedInclude,
-    GeneratedWebIDLFile,
     HostProgram,
     HostSimpleProgram,
     InstallationTarget,
@@ -35,17 +35,13 @@ from ..frontend.data import (
     JavaJarData,
     LibraryDefinition,
     LocalInclude,
-    PreprocessedTestWebIDLFile,
-    PreprocessedWebIDLFile,
     Program,
     SandboxDerived,
     SandboxWrapped,
     SimpleProgram,
-    TestWebIDLFile,
+    TestManifest,
     VariablePassthru,
     XPIDLFile,
-    TestManifest,
-    WebIDLFile,
 )
 from ..util import (
     ensureParentDir,
@@ -270,12 +266,6 @@ class RecursiveMakeBackend(CommonBackend):
 
         self._backend_files = {}
         self._ipdl_sources = set()
-        self._webidl_sources = set()
-        self._generated_events_webidl_sources = set()
-        self._test_webidl_sources = set()
-        self._preprocessed_test_webidl_sources = set()
-        self._preprocessed_webidl_sources = set()
-        self._generated_webidl_sources = set()
 
         def detailed(summary):
             s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
@@ -410,33 +400,6 @@ class RecursiveMakeBackend(CommonBackend):
         elif isinstance(obj, IPDLFile):
             self._ipdl_sources.add(mozpath.join(obj.srcdir, obj.basename))
 
-        elif isinstance(obj, WebIDLFile):
-            self._webidl_sources.add(mozpath.join(obj.srcdir, obj.basename))
-            self._process_webidl_basename(obj.basename)
-
-        elif isinstance(obj, GeneratedEventWebIDLFile):
-            self._generated_events_webidl_sources.add(mozpath.join(obj.srcdir, obj.basename))
-
-        elif isinstance(obj, TestWebIDLFile):
-            self._test_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                       obj.basename))
-            # Test WebIDL files are not exported.
-
-        elif isinstance(obj, PreprocessedTestWebIDLFile):
-            self._preprocessed_test_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                                    obj.basename))
-            # Test WebIDL files are not exported.
-
-        elif isinstance(obj, GeneratedWebIDLFile):
-            self._generated_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                            obj.basename))
-            self._process_webidl_basename(obj.basename)
-
-        elif isinstance(obj, PreprocessedWebIDLFile):
-            self._preprocessed_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                               obj.basename))
-            self._process_webidl_basename(obj.basename)
-
         elif isinstance(obj, Program):
             self._process_program(obj.program, backend_file)
 
@@ -607,6 +570,9 @@ class RecursiveMakeBackend(CommonBackend):
                                  poison_windows_h=False,
                                  files_per_unified_file=16):
 
+        # In case it's a generator.
+        files = sorted(files)
+
         explanation = "\n" \
             "# We build files in 'unified' mode by including several files\n" \
             "# together into a single source file.  This cuts down on\n" \
@@ -632,7 +598,7 @@ class RecursiveMakeBackend(CommonBackend):
                 return itertools.izip_longest(fillvalue=dummy_fill_value, *args)
 
             for i, unified_group in enumerate(grouper(files_per_unified_file,
-                                                      sorted(files))):
+                                                      files)):
                 just_the_filenames = list(filter_out_dummy(unified_group))
                 yield '%s%d.%s' % (unified_prefix, i, unified_suffix), just_the_filenames
 
@@ -750,42 +716,12 @@ class RecursiveMakeBackend(CommonBackend):
         with self._write_file(mozpath.join(ipdl_dir, 'ipdlsrcs.mk')) as ipdls:
             mk.dump(ipdls, removal_guard=False)
 
-        self._may_skip['compile'] -= set(['ipc/ipdl'])
-
-        # Write out master lists of WebIDL source files.
-        bindings_dir = mozpath.join(self.environment.topobjdir, 'dom', 'bindings')
-
-        mk = mozmakeutil.Makefile()
-
-        def write_var(variable, sources):
-            files = [mozpath.basename(f) for f in sorted(sources)]
-            mk.add_statement('%s += %s' % (variable, ' '.join(files)))
-        write_var('webidl_files', self._webidl_sources)
-        write_var('generated_events_webidl_files', self._generated_events_webidl_sources)
-        write_var('test_webidl_files', self._test_webidl_sources)
-        write_var('preprocessed_test_webidl_files', self._preprocessed_test_webidl_sources)
-        write_var('generated_webidl_files', self._generated_webidl_sources)
-        write_var('preprocessed_webidl_files', self._preprocessed_webidl_sources)
-
-        all_webidl_files = itertools.chain(iter(self._webidl_sources),
-                                           iter(self._generated_events_webidl_sources),
-                                           iter(self._generated_webidl_sources),
-                                           iter(self._preprocessed_webidl_sources))
-        all_webidl_files = [mozpath.basename(x) for x in all_webidl_files]
-        all_webidl_sources = [re.sub(r'\.webidl$', 'Binding.cpp', x) for x in all_webidl_files]
-
-        self._add_unified_build_rules(mk, all_webidl_sources,
-                                      bindings_dir,
-                                      unified_prefix='UnifiedBindings',
-                                      unified_files_makefile_variable='unified_binding_cpp_files',
-                                      poison_windows_h=True)
-
-        # Assume that Somebody Else has responsibility for correctly
-        # specifying removal dependencies for |all_webidl_sources|.
-        with self._write_file(mozpath.join(bindings_dir, 'webidlsrcs.mk')) as webidls:
-            mk.dump(webidls, removal_guard=False)
-
-        self._may_skip['compile'] -= set(['dom/bindings', 'dom/bindings/test'])
+        # These contain autogenerated sources that the build config doesn't
+        # yet know about.
+        # TODO Emit GENERATED_SOURCES so these special cases are dealt with
+        # the proper way.
+        self._may_skip['compile'] -= {'ipc/ipdl'}
+        self._may_skip['compile'] -= {'dom/bindings', 'dom/bindings/test'}
 
         self._fill_root_mk()
 
@@ -1026,10 +962,6 @@ class RecursiveMakeBackend(CommonBackend):
     def _process_host_simple_program(self, program, backend_file):
         backend_file.write('HOST_SIMPLE_PROGRAMS += %s\n' % program)
 
-    def _process_webidl_basename(self, basename):
-        header = 'mozilla/dom/%sBinding.h' % mozpath.splitext(basename)[0]
-        self._install_manifests['dist_include'].add_optional_exists(header)
-
     def _process_test_manifest(self, obj, backend_file):
         # Much of the logic in this function could be moved to CommonBackend.
         self.backend_input_files.add(mozpath.join(obj.topsrcdir,
@@ -1171,3 +1103,86 @@ class RecursiveMakeBackend(CommonBackend):
             # Makefile.in files, the old file will get replaced with
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
+
+    def _handle_webidl_collection(self, webidls):
+        if not webidls.all_stems():
+            return
+
+        bindings_dir = mozpath.join(self.environment.topobjdir, 'dom',
+            'bindings')
+
+        all_inputs = set(webidls.all_static_sources())
+        for s in webidls.all_non_static_basenames():
+            all_inputs.add(mozpath.join(bindings_dir, s))
+
+        generated_events_stems = webidls.generated_events_stems()
+        exported_stems = webidls.all_regular_stems()
+
+        # The WebIDL manager reads configuration from a JSON file. So, we
+        # need to write this file early.
+        o = dict(
+            webidls=sorted(all_inputs),
+            generated_events_stems=sorted(generated_events_stems),
+            exported_stems=sorted(exported_stems),
+        )
+
+        file_lists = mozpath.join(bindings_dir, 'file-lists.json')
+        with self._write_file(file_lists) as fh:
+            json.dump(o, fh, sort_keys=True, indent=2)
+
+        manager = mozwebidlcodegen.create_build_system_manager(
+            self.environment.topsrcdir,
+            self.environment.topobjdir,
+            mozpath.join(self.environment.topobjdir, 'dist')
+        )
+
+        # The manager is the source of truth on what files are generated.
+        # Consult it for install manifests.
+        include_dir = mozpath.join(self.environment.topobjdir, 'dist',
+            'include')
+        for f in manager.expected_build_output_files():
+            if f.startswith(include_dir):
+                self._install_manifests['dist_include'].add_optional_exists(
+                    mozpath.relpath(f, include_dir))
+
+        # We pass WebIDL info to make via a completely generated make file.
+        mk = Makefile()
+        mk.add_statement('nonstatic_webidl_files := %s' % ' '.join(
+            sorted(webidls.all_non_static_basenames())))
+        mk.add_statement('globalgen_sources := %s' % ' '.join(
+            sorted(manager.GLOBAL_DEFINE_FILES)))
+        mk.add_statement('test_sources := %s' % ' '.join(
+            sorted('%sBinding.cpp' % s for s in webidls.all_test_stems())))
+
+        # Add rules to preprocess bindings.
+        # This should ideally be using PP_TARGETS. However, since the input
+        # filenames match the output filenames, the existing PP_TARGETS rules
+        # result in circular dependencies and other make weirdness. One
+        # solution is to rename the input or output files repsectively. See
+        # bug 928195 comment 129.
+        for source in sorted(webidls.all_preprocessed_sources()):
+            basename = os.path.basename(source)
+            rule = mk.create_rule([basename])
+            rule.add_dependencies([source, '$(GLOBAL_DEPS)'])
+            rule.add_commands([
+                # Remove the file before writing so bindings that go from
+                # static to preprocessed don't end up writing to a symlink,
+                # which would modify content in the source directory.
+                '$(RM) $@',
+                '$(call py_action,preprocessor,$(DEFINES) $(ACDEFINES) '
+                    '$(XULPPFLAGS) $< -o $@)'
+            ])
+
+        # Bindings are compiled in unified mode to speed up compilation and
+        # to reduce linker memory size. Note that test bindings are separated
+        # from regular ones so tests bindings aren't shipped.
+        self._add_unified_build_rules(mk,
+            webidls.all_regular_cpp_basenames(),
+            bindings_dir,
+            unified_prefix='UnifiedBindings',
+            unified_files_makefile_variable='unified_binding_cpp_files',
+            poison_windows_h=True)
+
+        webidls_mk = mozpath.join(bindings_dir, 'webidlsrcs.mk')
+        with self._write_file(webidls_mk) as fh:
+            mk.dump(fh, removal_guard=False)
diff --git a/python/mozbuild/mozbuild/base.py b/python/mozbuild/mozbuild/base.py
index 0c006855d0d4..6043c4e8f3e5 100644
--- a/python/mozbuild/mozbuild/base.py
+++ b/python/mozbuild/mozbuild/base.py
@@ -273,6 +273,10 @@ class MozbuildObject(ProcessExecutionMixin):
     def bindir(self):
         return os.path.join(self.topobjdir, 'dist', 'bin')
 
+    @property
+    def includedir(self):
+        return os.path.join(self.topobjdir, 'dist', 'include')
+
     @property
     def statedir(self):
         return os.path.join(self.topobjdir, '.mozbuild')

From faf292b942f8045390ec7af8d1b3116d36384a7f Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Thu, 14 Nov 2013 10:34:55 -0800
Subject: [PATCH 003/144] Bug 928195 - Part 5: mach command for generating
 WebIDL example files; r=froydnj

--HG--
extra : rebase_source : c74d5f9556ca866622b7fefd4711e96fe4e4e020
---
 dom/bindings/mach_commands.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dom/bindings/mach_commands.py b/dom/bindings/mach_commands.py
index e176d91cd4e3..8b890c94b319 100644
--- a/dom/bindings/mach_commands.py
+++ b/dom/bindings/mach_commands.py
@@ -18,6 +18,17 @@ from mozbuild.base import MachCommandBase
 
 @CommandProvider
 class WebIDLProvider(MachCommandBase):
+    @Command('webidl-example', category='misc',
+        description='Generate example files for a WebIDL interface.')
+    @CommandArgument('interface', nargs='+',
+        help='Interface(s) whose examples to generate.')
+    def webidl_example(self, interface):
+        from mozwebidlcodegen import BuildSystemWebIDL
+
+        manager = self._spawn(BuildSystemWebIDL).manager
+        for i in interface:
+            manager.generate_example_files(i)
+
     @Command('webidl-parser-test', category='testing',
         description='Run WebIDL tests.')
     @CommandArgument('--verbose', '-v', action='store_true',

From 4190812d0a0f93dd62c1ba0644e5cb89408a49b4 Mon Sep 17 00:00:00 2001
From: Mark Hammond <mhammond@skippinet.com.au>
Date: Fri, 13 Dec 2013 14:24:36 +1100
Subject: [PATCH 004/144] Bug 935793 (part 1) - Add ownerIsBrowserOrApp to
 nsIFrameLoader. r=smaug

--HG--
extra : rebase_source : 189b45b39c04e4272d7b0cc188f35bb02bc19970
---
 content/base/public/nsIFrameLoader.idl | 7 ++++++-
 content/base/src/nsFrameLoader.cpp     | 8 ++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/content/base/public/nsIFrameLoader.idl b/content/base/public/nsIFrameLoader.idl
index a2f3e812d621..bcbc5fd93028 100644
--- a/content/base/public/nsIFrameLoader.idl
+++ b/content/base/public/nsIFrameLoader.idl
@@ -111,7 +111,7 @@ interface nsIContentViewManager : nsISupports
   readonly attribute nsIContentView rootContentView;
 };
 
-[scriptable, builtinclass, uuid(5b9949dc-56f1-47b6-b6d2-3785bb90ed6d)]
+[scriptable, builtinclass, uuid(a723673b-a26e-4cc6-ae23-ec70df9d97c9)]
 interface nsIFrameLoader : nsISupports
 {
   /**
@@ -272,6 +272,11 @@ interface nsIFrameLoader : nsISupports
    * have a notion of visibility in the parent process when frames are OOP.
    */
   [infallible] attribute boolean visible;
+
+  /**
+   * Find out whether the owner content really is a browser or app frame
+   */
+  readonly attribute boolean ownerIsBrowserOrAppFrame;
 };
 
 %{C++
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 1c4d99da8d62..306a90fedc4c 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -1409,6 +1409,14 @@ nsFrameLoader::OwnerIsBrowserOrAppFrame()
   return browserFrame ? browserFrame->GetReallyIsBrowserOrApp() : false;
 }
 
+// The xpcom getter version
+NS_IMETHODIMP
+nsFrameLoader::GetOwnerIsBrowserOrAppFrame(bool* aResult)
+{
+  *aResult = OwnerIsBrowserOrAppFrame();
+  return NS_OK;
+}
+
 bool
 nsFrameLoader::OwnerIsAppFrame()
 {

From 4834261c634406983a4a33278dc3139867b6b2db Mon Sep 17 00:00:00 2001
From: Mark Hammond <mhammond@skippinet.com.au>
Date: Fri, 13 Dec 2013 14:24:37 +1100
Subject: [PATCH 005/144] Bug 935793 (part 2) - rename browser-shown
 notifications and send them for all frames. r=smaug

--HG--
extra : rebase_source : 475b2cafc094117a2edf8ba95605e7f4d5f95410
---
 accessible/src/jsat/AccessFu.jsm            | 20 ++++++++++-------
 b2g/components/ErrorPage.jsm                |  8 +++++--
 content/base/src/nsFrameLoader.cpp          | 24 ++++++++++-----------
 dom/browser-element/BrowserElementParent.js | 16 ++++++++++----
 dom/inputmethod/Keyboard.jsm                |  8 +++++--
 dom/ipc/ProcessPriorityManager.cpp          | 11 ++++++++--
 6 files changed, 56 insertions(+), 31 deletions(-)

diff --git a/accessible/src/jsat/AccessFu.jsm b/accessible/src/jsat/AccessFu.jsm
index c0cf612968c5..fb7bcdbbd263 100644
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -118,8 +118,8 @@ this.AccessFu = {
     Output.start();
     TouchAdapter.start();
 
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-shown', false);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
     Services.obs.addObserver(this, 'Accessibility:NextObject', false);
     Services.obs.addObserver(this, 'Accessibility:PreviousObject', false);
     Services.obs.addObserver(this, 'Accessibility:Focus', false);
@@ -162,8 +162,8 @@ this.AccessFu = {
     Utils.win.removeEventListener('TabClose', this);
     Utils.win.removeEventListener('TabSelect', this);
 
-    Services.obs.removeObserver(this, 'remote-browser-frame-shown');
-    Services.obs.removeObserver(this, 'in-process-browser-or-app-frame-shown');
+    Services.obs.removeObserver(this, 'remote-browser-shown');
+    Services.obs.removeObserver(this, 'inprocess-browser-shown');
     Services.obs.removeObserver(this, 'Accessibility:NextObject');
     Services.obs.removeObserver(this, 'Accessibility:PreviousObject');
     Services.obs.removeObserver(this, 'Accessibility:Focus');
@@ -304,11 +304,15 @@ this.AccessFu = {
       case 'Accessibility:MoveByGranularity':
         this.Input.moveByGranularity(JSON.parse(aData));
         break;
-      case 'remote-browser-frame-shown':
-      case 'in-process-browser-or-app-frame-shown':
+      case 'remote-browser-shown':
+      case 'inprocess-browser-shown':
       {
-        let mm = aSubject.QueryInterface(Ci.nsIFrameLoader).messageManager;
-        this._handleMessageManager(mm);
+        // Ignore notifications that aren't from a BrowserOrApp
+        let frameLoader = aSubject.QueryInterface(Ci.nsIFrameLoader);
+        if (!frameLoader.ownerIsBrowserOrAppFrame) {
+          return;
+        }
+        this._handleMessageManager(frameLoader.messageManager);
         break;
       }
     }
diff --git a/b2g/components/ErrorPage.jsm b/b2g/components/ErrorPage.jsm
index 8b6c2985e638..ba9cb3af03e0 100644
--- a/b2g/components/ErrorPage.jsm
+++ b/b2g/components/ErrorPage.jsm
@@ -150,12 +150,16 @@ let ErrorPage = {
   },
 
   init: function errorPageInit() {
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-shown', false);
   },
 
   observe: function errorPageObserve(aSubject, aTopic, aData) {
     let frameLoader = aSubject.QueryInterface(Ci.nsIFrameLoader);
+    // Ignore notifications that aren't from a BrowserOrApp
+    if (!frameLoader.ownerIsBrowserOrAppFrame) {
+      return;
+    }
     let mm = frameLoader.messageManager;
 
     // This won't happen from dom/ipc/preload.js in non-OOP builds.
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 306a90fedc4c..9c74e96b4ae9 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -948,9 +948,9 @@ nsFrameLoader::ShowRemoteFrame(const nsIntSize& size,
     EnsureMessageManager();
 
     nsCOMPtr<nsIObserverService> os = services::GetObserverService();
-    if (OwnerIsBrowserOrAppFrame() && os && !mRemoteBrowserInitialized) {
+    if (os && !mRemoteBrowserInitialized) {
       os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
-                          "remote-browser-frame-shown", nullptr);
+                          "remote-browser-shown", nullptr);
       mRemoteBrowserInitialized = true;
     }
   } else {
@@ -1685,18 +1685,16 @@ nsFrameLoader::MaybeCreateDocShell()
     mDocShell->SetIsBrowserInsideApp(containingAppId);
   }
 
-  if (OwnerIsBrowserOrAppFrame()) {
-    nsCOMPtr<nsIObserverService> os = services::GetObserverService();
-    if (os) {
-      os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
-                          "in-process-browser-or-app-frame-shown", nullptr);
-    }
+  nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+  if (os) {
+    os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
+                        "inprocess-browser-shown", nullptr);
+  }
 
-    if (mMessageManager) {
-      mMessageManager->LoadFrameScript(
-        NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js"),
-        /* allowDelayedLoad = */ true);
-    }
+  if (OwnerIsBrowserOrAppFrame() && mMessageManager) {
+    mMessageManager->LoadFrameScript(
+      NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js"),
+      /* allowDelayedLoad = */ true);
   }
 
   return NS_OK;
diff --git a/dom/browser-element/BrowserElementParent.js b/dom/browser-element/BrowserElementParent.js
index 9bd9dd4280a3..b4741d477e0a 100644
--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -65,8 +65,8 @@ BrowserElementParentFactory.prototype = {
     // alive for as long as its frame element lives.
     this._bepMap = new WeakMap();
 
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', /* ownsWeak = */ true);
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', /* ownsWeak = */ true);
+    Services.obs.addObserver(this, 'remote-browser-shown', /* ownsWeak = */ true);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', /* ownsWeak = */ true);
   },
 
   _browserFramesPrefEnabled: function() {
@@ -79,11 +79,19 @@ BrowserElementParentFactory.prototype = {
   },
 
   _observeInProcessBrowserFrameShown: function(frameLoader) {
+    // Ignore notifications that aren't from a BrowserOrApp
+    if (!frameLoader.QueryInterface(Ci.nsIFrameLoader).ownerIsBrowserOrAppFrame) {
+      return;
+    }
     debug("In-process browser frame shown " + frameLoader);
     this._createBrowserElementParent(frameLoader, /* hasRemoteFrame = */ false);
   },
 
   _observeRemoteBrowserFrameShown: function(frameLoader) {
+    // Ignore notifications that aren't from a BrowserOrApp
+    if (!frameLoader.QueryInterface(Ci.nsIFrameLoader).ownerIsBrowserOrAppFrame) {
+      return;
+    }
     debug("Remote browser frame shown " + frameLoader);
     this._createBrowserElementParent(frameLoader, /* hasRemoteFrame = */ true);
   },
@@ -103,10 +111,10 @@ BrowserElementParentFactory.prototype = {
         this._init();
       }
       break;
-    case 'remote-browser-frame-shown':
+    case 'remote-browser-shown':
       this._observeRemoteBrowserFrameShown(subject);
       break;
-    case 'in-process-browser-or-app-frame-shown':
+    case 'inprocess-browser-shown':
       this._observeInProcessBrowserFrameShown(subject);
       break;
     case 'content-document-global-created':
diff --git a/dom/inputmethod/Keyboard.jsm b/dom/inputmethod/Keyboard.jsm
index 14b56041be66..94456ff8d510 100644
--- a/dom/inputmethod/Keyboard.jsm
+++ b/dom/inputmethod/Keyboard.jsm
@@ -44,8 +44,8 @@ this.Keyboard = {
   },
 
   init: function keyboardInit() {
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-shown', false);
     Services.obs.addObserver(this, 'oop-frameloader-crashed', false);
 
     for (let name of this._messageNames)
@@ -63,6 +63,10 @@ this.Keyboard = {
         ppmm.broadcastAsyncMessage('Keyboard:FocusChange', { 'type': 'blur' });
       }
     } else {
+      // Ignore notifications that aren't from a BrowserOrApp
+      if (!frameLoader.ownerIsBrowserOrAppFrame) {
+        return;
+      }
       this.initFormsFrameScript(mm);
     }
   },
diff --git a/dom/ipc/ProcessPriorityManager.cpp b/dom/ipc/ProcessPriorityManager.cpp
index d6bb96cd352c..b9c34d7801cc 100644
--- a/dom/ipc/ProcessPriorityManager.cpp
+++ b/dom/ipc/ProcessPriorityManager.cpp
@@ -602,7 +602,7 @@ ParticularProcessPriorityManager::Init()
   nsCOMPtr<nsIObserverService> os = services::GetObserverService();
   if (os) {
     os->AddObserver(this, "audio-channel-process-changed", /* ownsWeak */ true);
-    os->AddObserver(this, "remote-browser-frame-shown", /* ownsWeak */ true);
+    os->AddObserver(this, "remote-browser-shown", /* ownsWeak */ true);
     os->AddObserver(this, "ipc:browser-destroyed", /* ownsWeak */ true);
     os->AddObserver(this, "frameloader-visible-changed", /* ownsWeak */ true);
   }
@@ -674,7 +674,7 @@ ParticularProcessPriorityManager::Observe(nsISupports* aSubject,
 
   if (topic.EqualsLiteral("audio-channel-process-changed")) {
     OnAudioChannelProcessChanged(aSubject);
-  } else if (topic.EqualsLiteral("remote-browser-frame-shown")) {
+  } else if (topic.EqualsLiteral("remote-browser-shown")) {
     OnRemoteBrowserFrameShown(aSubject);
   } else if (topic.EqualsLiteral("ipc:browser-destroyed")) {
     OnTabParentDestroyed(aSubject);
@@ -747,6 +747,13 @@ ParticularProcessPriorityManager::OnRemoteBrowserFrameShown(nsISupports* aSubjec
   nsCOMPtr<nsIFrameLoader> fl = do_QueryInterface(aSubject);
   NS_ENSURE_TRUE_VOID(fl);
 
+  // Ignore notifications that aren't from a BrowserOrApp
+  bool isBrowserOrApp;
+  fl->GetOwnerIsBrowserOrAppFrame(&isBrowserOrApp);
+  if (!isBrowserOrApp) {
+    return;
+  }
+
   nsCOMPtr<nsITabParent> tp;
   fl->GetTabParent(getter_AddRefs(tp));
   NS_ENSURE_TRUE_VOID(tp);

From 59eb74b6f543a3a03d5707847cb8f138e35f9f7f Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Thu, 12 Dec 2013 19:38:49 -0800
Subject: [PATCH 006/144] Bug 944492, part 1 - Make XPCWrappedJS use the purple
 buffer. r=smaug

---
 js/xpconnect/src/XPCWrappedJS.cpp | 128 ++++++++++++++++++++----------
 js/xpconnect/src/xpcprivate.h     |  15 ++--
 2 files changed, 92 insertions(+), 51 deletions(-)

diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index f97b28c84ca2..f0217a990cf2 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -16,6 +16,40 @@ using namespace mozilla;
 
 // NOTE: much of the fancy footwork is done in xpcstubs.cpp
 
+
+// nsXPCWrappedJS lifetime.
+//
+// An nsXPCWrappedJS is either rooting its JS object or is subject to finalization.
+// The subject-to-finalization state lets wrappers support
+// nsSupportsWeakReference in the case where the underlying JS object
+// is strongly owned, but the wrapper itself is only weakly owned.
+//
+// A wrapper is rooting its JS object whenever its refcount is greater than 1. In
+// this state, root wrappers are always added to the cycle collector graph. The
+// wrapper keeps around an extra refcount, added in the constructor, to support
+// the possibility of an eventual transition to the subject-to-finalization state.
+// This extra refcount is ignored by the cycle collector, which traverses the "self"
+// edge for this refcount.
+//
+// When the refcount of a rooting wrapper drops to 1, if there is no weak reference
+// to the wrapper (which can only happen for the root wrapper), it is immediately
+// Destroy()'d. Otherwise, it becomes subject to finalization.
+//
+// When a wrapper is subject to finalization, the wrapper has a refcount of 1. It is
+// now owned exclusively by its JS object. Either a weak reference will be turned into
+// a strong ref which will bring its refcount up to 2 and change the wrapper back to
+// the rooting state, or it will stay alive until the JS object dies. If the JS object
+// dies, then when XPCJSRuntime::FinalizeCallback calls FindDyingJSObjects
+// it will find the wrapper and call Release() in it, destroying the wrapper.
+// Otherwise, the wrapper will stay alive, even if it no longer has a weak reference
+// to it.
+//
+// When the wrapper is subject to finalization, it is kept alive by an implicit reference
+// from the JS object which is invisible to the cycle collector, so the cycle collector
+// does not traverse any children of wrappers that are subject to finalization. This will
+// result in a leak if a wrapper in the non-rooting state has an aggregated native that
+// keeps alive the wrapper's JS object.  See bug 947049.
+
 NS_IMETHODIMP
 NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
    (void *p, nsCycleCollectionTraversalCallback &cb)
@@ -37,14 +71,17 @@ NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
         NS_IMPL_CYCLE_COLLECTION_DESCRIBE(nsXPCWrappedJS, refcnt)
     }
 
-    // nsXPCWrappedJS keeps its own refcount artificially at or above 1, see the
-    // comment above nsXPCWrappedJS::AddRef.
+    // A wrapper that is subject to finalization will only die when its JS object dies.
+    if (tmp->IsSubjectToFinalization())
+        return NS_OK;
+
+    // Don't let the extra reference for nsSupportsWeakReference keep a wrapper that is
+    // not subject to finalization alive.
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "self");
     cb.NoteXPCOMChild(s);
 
-    if (refcnt > 1) {
-        // nsXPCWrappedJS roots its mJSObj when its refcount is > 1, see
-        // the comment above nsXPCWrappedJS::AddRef.
+    if (tmp->IsValid()) {
+        MOZ_ASSERT(refcnt > 1);
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mJSObj");
         cb.NoteJSChild(tmp->GetJSObjectPreserveColor());
     }
@@ -54,7 +91,7 @@ NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
         cb.NoteXPCOMChild(tmp->GetAggregatedNativeObject());
     } else {
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "root");
-        cb.NoteXPCOMChild(static_cast<nsIXPConnectWrappedJS*>(tmp->GetRootWrapper()));
+        cb.NoteXPCOMChild(ToSupports(tmp->GetRootWrapper()));
     }
 
     return NS_OK;
@@ -127,37 +164,22 @@ nsXPCWrappedJS::QueryInterface(REFNSIID aIID, void** aInstancePtr)
 }
 
 
-// Refcounting is now similar to that used in the chained (pre-flattening)
-// wrappednative system.
-//
-// We are now holding an extra refcount for nsISupportsWeakReference support.
-//
-// Non-root wrappers remove themselves from the chain in their destructors.
-// We root the JSObject as the refcount transitions from 1->2. And we unroot
-// the JSObject when the refcount transitions from 2->1.
-//
-// When the transition from 2->1 is made and no one holds a weak ref to the
-// (aggregated) object then we decrement the refcount again to 0 (and
-// destruct) . However, if a weak ref is held at the 2->1 transition, then we
-// leave the refcount at 1 to indicate that state. This leaves the JSObject
-// no longer rooted by us and (as far as we know) subject to possible
-// collection. Code in XPCJSRuntime watches for JS gc to happen and will do
-// the final release on wrappers whose JSObjects get finalized. Note that
-// even after tranistioning to this refcount-of-one state callers might do
-// an addref and cause us to re-root the JSObject and continue on more normally.
+// For a description of nsXPCWrappedJS lifetime and reference counting, see
+// the comment at the top of this file.
 
 nsrefcnt
 nsXPCWrappedJS::AddRef(void)
 {
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
-    nsrefcnt cnt = ++mRefCnt;
+
+    MOZ_ASSERT(int32_t(mRefCnt) >= 0, "illegal refcnt");
+    nsrefcnt cnt = mRefCnt.incr();
     NS_LOG_ADDREF(this, cnt, "nsXPCWrappedJS", sizeof(*this));
 
     if (2 == cnt && IsValid()) {
         GetJSObject(); // Unmark gray JSObject.
-        XPCJSRuntime* rt = mClass->GetRuntime();
-        rt->AddWrappedJSRoot(this);
+        mClass->GetRuntime()->AddWrappedJSRoot(this);
     }
 
     return cnt;
@@ -168,31 +190,44 @@ nsXPCWrappedJS::Release(void)
 {
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
-    NS_PRECONDITION(0 != mRefCnt, "dup release");
+    MOZ_ASSERT(int32_t(mRefCnt) > 0, "dup release");
+    NS_ASSERT_OWNINGTHREAD(nsXPCWrappedJS);
 
-do_decrement:
-
-    nsrefcnt cnt = --mRefCnt;
+    bool shouldDelete = false;
+    nsISupports *base = NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Upcast(this);
+    nsrefcnt cnt = mRefCnt.decr(base, &shouldDelete);
     NS_LOG_RELEASE(this, cnt, "nsXPCWrappedJS");
 
     if (0 == cnt) {
-        delete this;   // also unlinks us from chain
-        return 0;
-    }
-    if (1 == cnt) {
+        if (MOZ_UNLIKELY(shouldDelete)) {
+            mRefCnt.stabilizeForDeletion();
+            DeleteCycleCollectable();
+        } else {
+            mRefCnt.incr();
+            Destroy();
+            mRefCnt.decr(base);
+        }
+    } else if (1 == cnt) {
         if (IsValid())
             RemoveFromRootSet();
 
-        // If we are not the root wrapper or if we are not being used from a
-        // weak reference, then this extra ref is not needed and we can let
-        // ourself be deleted.
-        // Note: HasWeakReferences() could only return true for the root.
+        // If we are not a root wrapper being used from a weak reference,
+        // then the extra ref is not needed and we can let outselves be
+        // deleted.
         if (!HasWeakReferences())
-            goto do_decrement;
+            return Release();
+
+        MOZ_ASSERT(IsRootWrapper(), "Only root wrappers should have weak references");
     }
     return cnt;
 }
 
+NS_IMETHODIMP_(void)
+nsXPCWrappedJS::DeleteCycleCollectable(void)
+{
+    delete this;
+}
+
 void
 nsXPCWrappedJS::TraceJS(JSTracer* trc)
 {
@@ -345,9 +380,12 @@ nsXPCWrappedJS::nsXPCWrappedJS(JSContext* cx,
 {
     InitStub(GetClass()->GetIID());
 
-    // intentionally do double addref - see Release().
+    // There is an extra AddRef to support weak references to wrappers
+    // that are subject to finalization. See the top of the file for more
+    // details.
     NS_ADDREF_THIS();
     NS_ADDREF_THIS();
+
     NS_ADDREF(aClass);
     NS_IF_ADDREF(mOuter);
 
@@ -358,7 +396,13 @@ nsXPCWrappedJS::nsXPCWrappedJS(JSContext* cx,
 
 nsXPCWrappedJS::~nsXPCWrappedJS()
 {
-    NS_PRECONDITION(0 == mRefCnt, "refcounting error");
+    Destroy();
+}
+
+void
+nsXPCWrappedJS::Destroy()
+{
+    MOZ_ASSERT(1 == int32_t(mRefCnt), "should be stabilized for deletion");
 
     if (IsRootWrapper()) {
         XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 99c2265a685b..2d9f539eba02 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2464,14 +2464,13 @@ class nsXPCWrappedJS : protected nsAutoXPTCStub,
                        public XPCRootSetElem
 {
 public:
-    NS_DECL_THREADSAFE_ISUPPORTS
+    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
     NS_DECL_NSIXPCONNECTWRAPPEDJS
     NS_DECL_NSISUPPORTSWEAKREFERENCE
     NS_DECL_NSIPROPERTYBAG
 
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXPCWrappedJS, nsIXPConnectWrappedJS)
-    void DeleteCycleCollectable() {}
 
     NS_IMETHOD CallMethod(uint16_t methodIndex,
                           const XPTMethodDescriptor *info,
@@ -2513,12 +2512,9 @@ public:
     bool IsValid() const {return mJSObj != nullptr;}
     void SystemIsBeingShutDown();
 
-    // This is used by XPCJSRuntime::GCCallback to find wrappers that no
-    // longer root their JSObject and are only still alive because they
-    // were being used via nsSupportsWeakReference at the time when their
-    // last (outside) reference was released. Wrappers that fit into that
-    // category are only deleted when we see that their corresponding JSObject
-    // is to be finalized.
+    // These two methods are used by JSObject2WrappedJSMap::FindDyingJSObjects
+    // to find non-rooting wrappers for dying JS objects. See the top of
+    // XPCWrappedJS.cpp for more details.
     bool IsSubjectToFinalization() const {return IsValid() && mRefCnt == 1;}
     bool IsObjectAboutToBeFinalized() {return JS_IsAboutToBeFinalized(&mJSObj);}
 
@@ -2537,7 +2533,8 @@ protected:
                    nsXPCWrappedJS* root,
                    nsISupports* aOuter);
 
-   void Unlink();
+    void Destroy();
+    void Unlink();
 
 private:
     JS::Heap<JSObject*> mJSObj;

From a324b39e7f60e8757e93492f604ba8ab1d5449d0 Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Thu, 12 Dec 2013 19:38:50 -0800
Subject: [PATCH 007/144] Bug 944492, part 2 - Make XPCWrappedJS a proper
 skippable class. r=smaug

---
 js/xpconnect/src/XPCJSRuntime.cpp | 37 +---------------------
 js/xpconnect/src/XPCWrappedJS.cpp | 51 +++++++++++++++++++++++++++++++
 js/xpconnect/src/xpcprivate.h     |  3 +-
 3 files changed, 54 insertions(+), 37 deletions(-)

diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 1a12e11d83b3..2f33a01747fa 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -668,35 +668,6 @@ XPCJSRuntime::SuspectWrappedNative(XPCWrappedNative *wrapper,
         cb.NoteJSRoot(obj);
 }
 
-bool
-CanSkipWrappedJS(nsXPCWrappedJS *wrappedJS)
-{
-    JSObject *obj = wrappedJS->GetJSObjectPreserveColor();
-    // If traversing wrappedJS wouldn't release it, nor
-    // cause any other objects to be added to the graph, no
-    // need to add it to the graph at all.
-    bool isRootWrappedJS = wrappedJS->IsRootWrapper();
-    if (nsCCUncollectableMarker::sGeneration &&
-        (!obj || !xpc_IsGrayGCThing(obj)) &&
-        !wrappedJS->IsSubjectToFinalization() &&
-        (isRootWrappedJS || CanSkipWrappedJS(wrappedJS->GetRootWrapper()))) {
-        if (!wrappedJS->IsAggregatedToNative() || !isRootWrappedJS) {
-            return true;
-        } else {
-            nsISupports* agg = wrappedJS->GetAggregatedNativeObject();
-            nsXPCOMCycleCollectionParticipant* cp = nullptr;
-            CallQueryInterface(agg, &cp);
-            nsISupports* canonical = nullptr;
-            agg->QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
-                                reinterpret_cast<void**>(&canonical));
-            if (cp && canonical && cp->CanSkipInCC(canonical)) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
 void
 XPCJSRuntime::TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback &cb)
 {
@@ -714,13 +685,7 @@ XPCJSRuntime::TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback &c
     }
 
     for (XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot()) {
-        nsXPCWrappedJS *wrappedJS = static_cast<nsXPCWrappedJS*>(e);
-        if (!cb.WantAllTraces() &&
-            CanSkipWrappedJS(wrappedJS)) {
-            continue;
-        }
-
-        cb.NoteXPCOMRoot(static_cast<nsIXPConnectWrappedJS *>(wrappedJS));
+        cb.NoteXPCOMRoot(ToSupports(static_cast<nsXPCWrappedJS*>(e)));
     }
 }
 
diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index f0217a990cf2..3480ef0f099b 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -8,6 +8,7 @@
 
 #include "xpcprivate.h"
 #include "jsprf.h"
+#include "nsCCUncollectableMarker.h"
 #include "nsCxPusher.h"
 #include "nsContentUtils.h"
 #include "nsThreadUtils.h"
@@ -50,6 +51,42 @@ using namespace mozilla;
 // result in a leak if a wrapper in the non-rooting state has an aggregated native that
 // keeps alive the wrapper's JS object.  See bug 947049.
 
+
+// If traversing wrappedJS wouldn't release it, nor cause any other objects to be
+// added to the graph, there is no need to add it to the graph at all.
+bool
+nsXPCWrappedJS::CanSkip()
+{
+    if (!nsCCUncollectableMarker::sGeneration)
+        return false;
+
+    if (IsSubjectToFinalization())
+        return true;
+
+    // If this wrapper holds a gray object, need to trace it.
+    JSObject *obj = GetJSObjectPreserveColor();
+    if (obj && xpc_IsGrayGCThing(obj))
+        return false;
+
+    // For non-root wrappers, check if the root wrapper will be
+    // added to the CC graph.
+    if (!IsRootWrapper())
+        return mRoot->CanSkip();
+
+    // For the root wrapper, check if there is an aggregated
+    // native object that will be added to the CC graph.
+    if (!IsAggregatedToNative())
+        return true;
+
+    nsISupports* agg = GetAggregatedNativeObject();
+    nsXPCOMCycleCollectionParticipant* cp = nullptr;
+    CallQueryInterface(agg, &cp);
+    nsISupports* canonical = nullptr;
+    agg->QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
+                        reinterpret_cast<void**>(&canonical));
+    return cp && canonical && cp->CanSkipThis(canonical);
+}
+
 NS_IMETHODIMP
 NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
    (void *p, nsCycleCollectionTraversalCallback &cb)
@@ -103,6 +140,20 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXPCWrappedJS)
     tmp->Unlink();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
+// XPCJSRuntime keeps a table of WJS, so we can remove them from
+// the purple buffer in between CCs.
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsXPCWrappedJS)
+    return true;
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsXPCWrappedJS)
+    return tmp->CanSkip();
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsXPCWrappedJS)
+    return tmp->CanSkip();
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
+
 NS_IMETHODIMP
 nsXPCWrappedJS::AggregatedQueryInterface(REFNSIID aIID, void** aInstancePtr)
 {
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 2d9f539eba02..249b21911746 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2470,7 +2470,7 @@ public:
     NS_DECL_NSISUPPORTSWEAKREFERENCE
     NS_DECL_NSIPROPERTYBAG
 
-    NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXPCWrappedJS, nsIXPConnectWrappedJS)
+    NS_DECL_CYCLE_COLLECTION_SKIPPABLE_CLASS_AMBIGUOUS(nsXPCWrappedJS, nsIXPConnectWrappedJS)
 
     NS_IMETHOD CallMethod(uint16_t methodIndex,
                           const XPTMethodDescriptor *info,
@@ -2533,6 +2533,7 @@ protected:
                    nsXPCWrappedJS* root,
                    nsISupports* aOuter);
 
+    bool CanSkip();
     void Destroy();
     void Unlink();
 

From f853c97cb8422c050ea8c3f5394552f35f7c3587 Mon Sep 17 00:00:00 2001
From: David Anderson <dvander@alliedmods.net>
Date: Thu, 12 Dec 2013 20:29:14 -0800
Subject: [PATCH 008/144] Ensure that the software compositor never uses
 deprecated textures (bug 947038, r=mattwoodrow).

---
 dom/ipc/TabChild.cpp                          |   5 +
 gfx/layers/basic/BasicCompositor.cpp          | 155 ------------------
 gfx/layers/client/ContentClient.cpp           |   5 +
 gfx/layers/composite/TextureHost.cpp          |   8 -
 gfx/layers/composite/ThebesLayerComposite.cpp |   1 +
 gfx/thebes/gfxPlatform.cpp                    |  20 +++
 gfx/thebes/gfxPlatform.h                      |   5 +-
 widget/xpwidgets/nsBaseWidget.cpp             |   2 +
 8 files changed, 37 insertions(+), 164 deletions(-)

diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 8306641297ff..7e88a30e1b88 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -72,6 +72,7 @@
 #include "APZCCallbackHelper.h"
 #include "nsILoadContext.h"
 #include "ipc/nsGUIEventIPC.h"
+#include "gfxPlatform.h"
 
 #ifdef DEBUG
 #include "PCOMContentPermissionRequestChild.h"
@@ -2281,6 +2282,10 @@ TabChild::InitRenderingState()
           NS_WARNING("failed to properly allocate layer transaction");
           return false;
         }
+
+        // Track which compositor backend is in use (see bug 947038). This can
+        // be removed when deprecated textures are removed.
+        gfxPlatform::GetPlatform()->SetCompositorBackend(mTextureFactoryIdentifier.mParentBackend);
     } else {
         // Pushing transactions to the parent content.
         shadowManager = remoteFrame->SendPLayerTransactionConstructor();
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index cc934831b3b8..0bc966af4163 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -63,161 +63,6 @@ public:
   RefPtr<gfx::DataSourceSurface> mSurface;
 };
 
-/**
- * Texture source and host implementaion for software compositing.
- */
-class DeprecatedTextureHostBasic : public DeprecatedTextureHost
-                                 , public TextureSourceBasic
-{
-public:
-  DeprecatedTextureHostBasic()
-  : mCompositor(nullptr)
-  {}
-
-  SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
-
-  virtual IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
-
-  virtual TextureSourceBasic* AsSourceBasic() MOZ_OVERRIDE { return this; }
-
-  SourceSurface *GetSurface() MOZ_OVERRIDE { return mSurface; }
-
-  virtual void SetCompositor(Compositor* aCompositor)
-  {
-    mCompositor = static_cast<BasicCompositor*>(aCompositor);
-  }
-
-  virtual const char *Name() { return "DeprecatedTextureHostBasic"; }
-
-protected:
-  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
-                          nsIntRegion *aRegion,
-                          nsIntPoint*) MOZ_OVERRIDE
-  {
-    AutoOpenSurface surf(OPEN_READ_ONLY, aImage);
-    nsRefPtr<gfxASurface> surface = ShadowLayerForwarder::OpenDescriptor(OPEN_READ_ONLY, aImage);
-    nsRefPtr<gfxImageSurface> image = surface->GetAsImageSurface();
-    mFormat = ImageFormatToSurfaceFormat(image->Format());
-    mSize = IntSize(image->Width(), image->Height());
-    mSurface = Factory::CreateWrappingDataSourceSurface(image->Data(),
-                                                        image->Stride(),
-                                                        mSize,
-                                                        mFormat);
-  }
-
-  virtual bool EnsureSurface() {
-    return true;
-  }
-
-  virtual bool Lock() MOZ_OVERRIDE {
-    return EnsureSurface();
-  }
-
-  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE {
-    if (!mSurface) {
-        return nullptr;
-    }
-    return mSurface->GetDataSurface();
-  }
-
-  BasicCompositor *mCompositor;
-  RefPtr<SourceSurface> mSurface;
-  IntSize mSize;
-  SurfaceFormat mFormat;
-};
-
-void
-DeserializerToPlanarYCbCrImageData(YCbCrImageDataDeserializer& aDeserializer, PlanarYCbCrData& aData)
-{
-  aData.mYChannel = aDeserializer.GetYData();
-  aData.mYStride = aDeserializer.GetYStride();
-  aData.mYSize = aDeserializer.GetYSize();
-  aData.mCbChannel = aDeserializer.GetCbData();
-  aData.mCrChannel = aDeserializer.GetCrData();
-  aData.mCbCrStride = aDeserializer.GetCbCrStride();
-  aData.mCbCrSize = aDeserializer.GetCbCrSize();
-  aData.mPicSize = aDeserializer.GetYSize();
-}
-
-class YCbCrDeprecatedTextureHostBasic : public DeprecatedTextureHostBasic
-{
-public:
-  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
-                          nsIntRegion *aRegion,
-                          nsIntPoint*) MOZ_OVERRIDE
-  {
-    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
-    mSurface = nullptr;
-    ConvertImageToRGB(aImage);
-  }
-
-  virtual void SwapTexturesImpl(const SurfaceDescriptor& aImage,
-                                nsIntRegion* aRegion) MOZ_OVERRIDE
-  {
-    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
-    mSurface = nullptr;
-  }
-
-  virtual bool EnsureSurface() MOZ_OVERRIDE
-  {
-    if (mSurface) {
-      return true;
-    }
-    if (!mBuffer) {
-      return false;
-    }
-    return ConvertImageToRGB(*mBuffer);
-  }
-
-  bool ConvertImageToRGB(const SurfaceDescriptor& aImage)
-  {
-    YCbCrImageDataDeserializer deserializer(aImage.get_YCbCrImage().data().get<uint8_t>());
-    PlanarYCbCrData data;
-    DeserializerToPlanarYCbCrImageData(deserializer, data);
-
-    gfxImageFormat format = gfxImageFormatRGB24;
-    gfxIntSize size;
-    gfxUtils::GetYCbCrToRGBDestFormatAndSize(data, format, size);
-    if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
-        size.height > PlanarYCbCrImage::MAX_DIMENSION) {
-      NS_ERROR("Illegal image dest width or height");
-      return false;
-    }
-
-    mSize = ToIntSize(size);
-    mFormat = (format == gfxImageFormatRGB24)
-              ? FORMAT_B8G8R8X8
-              : FORMAT_B8G8R8A8;
-
-    RefPtr<DataSourceSurface> surface = Factory::CreateDataSourceSurface(mSize, mFormat);
-    gfxUtils::ConvertYCbCrToRGB(data, format, size,
-                                surface->GetData(),
-                                surface->Stride());
-
-    mSurface = surface;
-    return true;
-  }
-};
-
-TemporaryRef<DeprecatedTextureHost>
-CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
-                             uint32_t aTextureHostFlags,
-                             uint32_t aTextureFlags)
-{
-  RefPtr<DeprecatedTextureHost> result = nullptr;
-  if (aDescriptorType == SurfaceDescriptor::TYCbCrImage) {
-    result = new YCbCrDeprecatedTextureHostBasic();
-  } else {
-    MOZ_ASSERT(aDescriptorType == SurfaceDescriptor::TShmem ||
-               aDescriptorType == SurfaceDescriptor::TMemoryImage,
-               "We can only support Shmem currently");
-    result = new DeprecatedTextureHostBasic();
-  }
-
-  result->SetFlags(aTextureFlags);
-  return result.forget();
-}
-
 BasicCompositor::BasicCompositor(nsIWidget *aWidget)
   : mWidget(aWidget)
 {
diff --git a/gfx/layers/client/ContentClient.cpp b/gfx/layers/client/ContentClient.cpp
index 544784812d91..157c01970fcf 100644
--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -58,6 +58,11 @@ ContentClient::CreateContentClient(CompositableForwarder* aForwarder)
   useDeprecatedTextures = gfxPlatform::GetPlatform()->UseDeprecatedTextures();
 #endif
 
+  // Always use new textures for the basic compositor.
+  if (backend == LAYERS_BASIC) {
+    useDeprecatedTextures = false;
+  }
+
 #ifdef XP_WIN
   if (backend == LAYERS_D3D11) {
     useDoubleBuffering = !!gfxWindowsPlatform::GetPlatform()->GetD2DDevice();
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 5e4da901d9ac..4caeb0b8030a 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -84,10 +84,6 @@ TextureHost::AsTextureHost(PTextureParent* actor)
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostOGL(SurfaceDescriptorType aDescriptorType,
                                                            uint32_t aDeprecatedTextureHostFlags,
                                                            uint32_t aTextureFlags);
-// implemented in BasicCompositor.cpp
-TemporaryRef<DeprecatedTextureHost> CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
-                                                             uint32_t aDeprecatedTextureHostFlags,
-                                                             uint32_t aTextureFlags);
 
 #ifdef XP_WIN
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostD3D9(SurfaceDescriptorType aDescriptorType,
@@ -127,10 +123,6 @@ DeprecatedTextureHost::CreateDeprecatedTextureHost(SurfaceDescriptorType aDescri
                                           aDeprecatedTextureHostFlags,
                                           aTextureFlags);
 #endif
-    case LAYERS_BASIC:
-      return CreateBasicDeprecatedTextureHost(aDescriptorType,
-                                          aDeprecatedTextureHostFlags,
-                                          aTextureFlags);
     default:
       MOZ_CRASH("Couldn't create texture host");
   }
diff --git a/gfx/layers/composite/ThebesLayerComposite.cpp b/gfx/layers/composite/ThebesLayerComposite.cpp
index 1f35533634d0..7a9cc3f00c45 100644
--- a/gfx/layers/composite/ThebesLayerComposite.cpp
+++ b/gfx/layers/composite/ThebesLayerComposite.cpp
@@ -138,6 +138,7 @@ ThebesLayerComposite::RenderLayer(const nsIntRect& aClipRect)
 
   mBuffer->SetPaintWillResample(MayResample());
 
+  mBuffer->SetCompositor(mCompositeManager->GetCompositor());
   mBuffer->Composite(effectChain,
                      GetEffectiveOpacity(),
                      transform,
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index b563f75429e4..89c74cc2c52e 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -281,6 +281,7 @@ gfxPlatform::gfxPlatform()
   , mDrawLayerBorders(false)
   , mDrawTileBorders(false)
   , mDrawBigImageBorders(false)
+  , mCompositorBackend(LAYERS_NONE)
 {
     mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
     mAllowDownloadableFonts = UNINITIALIZED_VALUE;
@@ -2213,3 +2214,22 @@ gfxPlatform::ComponentAlphaEnabled()
   InitLayersAccelerationPrefs();
   return sComponentAlphaEnabled;
 }
+
+void
+gfxPlatform::SetCompositorBackend(mozilla::layers::LayersBackend backend)
+{
+  // The compositor backend should always be the same after one has been chosen.
+  MOZ_ASSERT(mCompositorBackend == LAYERS_NONE || mCompositorBackend == backend);
+  if (mCompositorBackend == LAYERS_NONE) {
+    mCompositorBackend = backend;
+  }
+}
+
+bool
+gfxPlatform::UseDeprecatedTextures() const
+{
+  if (mCompositorBackend == LAYERS_BASIC) {
+    return false;
+  }
+  return mLayersUseDeprecated;
+}
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 27ff830fd51e..64d138698558 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -20,6 +20,7 @@
 #include "mozilla/RefPtr.h"
 #include "GfxInfoCollector.h"
 
+#include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/CompositorTypes.h"
 
 #ifdef XP_OS2
@@ -619,7 +620,8 @@ public:
      * This method should not be called from the compositor thread.
      */
     bool PreferMemoryOverShmem() const;
-    bool UseDeprecatedTextures() const { return mLayersUseDeprecated; }
+    bool UseDeprecatedTextures() const;
+    void SetCompositorBackend(mozilla::layers::LayersBackend backend);
 
 protected:
     gfxPlatform();
@@ -736,6 +738,7 @@ private:
     bool mDrawLayerBorders;
     bool mDrawTileBorders;
     bool mDrawBigImageBorders;
+    mozilla::layers::LayersBackend mCompositorBackend;
 };
 
 #endif /* GFX_PLATFORM_H */
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index 1916ced3277d..f8f4ce68d058 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -988,6 +988,8 @@ void nsBaseWidget::CreateCompositor(int aWidth, int aHeight)
     ImageBridgeChild::IdentifyCompositorTextureHost(textureFactoryIdentifier);
     WindowUsesOMTC();
 
+    gfxPlatform::GetPlatform()->SetCompositorBackend(textureFactoryIdentifier.mParentBackend);
+
     mLayerManager = lm;
     return;
   }

From db3e8ca04248c1ddfbc4b8e63cc130b44fb7b67b Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Fri, 13 Dec 2013 13:41:47 +0900
Subject: [PATCH 009/144] Bug 948245 part 1 - Rework and test repeat duration
 calculation; r=dholbert

In order to implement the min attribute properly we need to distinguish between
cases where the repeat duration is less than the active duration so we can apply
the fill mode in the 'gap'. Currently the repeat duration calculation is mostly
contained in GetRepeatDuration (but is hard to make sense of) and partly
contained in the call site CalcActiveEnd. Furthermore, it does not have thorough
tests (there were some unit tests but they were never converted to mochitests).

This patch reworks the repeat duration calculation so it is contained in one
place, easier to read, and thoroughly tested.
---
 content/smil/nsSMILRepeatCount.h              |   6 +-
 content/smil/nsSMILTimedElement.cpp           |  42 +++---
 content/smil/test/mochitest.ini               |   1 +
 .../smil/test/test_smilRepeatDuration.html    | 139 ++++++++++++++++++
 4 files changed, 162 insertions(+), 26 deletions(-)
 create mode 100644 content/smil/test/test_smilRepeatDuration.html

diff --git a/content/smil/nsSMILRepeatCount.h b/content/smil/nsSMILRepeatCount.h
index 18c6d66db618..8561fe4d8bd4 100644
--- a/content/smil/nsSMILRepeatCount.h
+++ b/content/smil/nsSMILRepeatCount.h
@@ -27,7 +27,11 @@ public:
   explicit nsSMILRepeatCount(double aCount)
     : mCount(kNotSet) { SetCount(aCount); }
 
-  operator double() const { return mCount; }
+  operator double() const {
+    MOZ_ASSERT(IsDefinite(),
+      "Converting indefinite or unset repeat count to double");
+    return mCount;
+  }
   bool IsDefinite() const {
     return mCount != kNotSet && mCount != kIndefinite;
   }
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 3538ca5d78b2..4ffde26796ed 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -1803,11 +1803,7 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,
   NS_ABORT_IF_FALSE(aBegin.IsDefinite(),
     "Indefinite or unresolved begin time in CalcActiveEnd");
 
-  if (mRepeatDur.IsIndefinite()) {
-    result.SetIndefinite();
-  } else {
-    result = GetRepeatDuration();
-  }
+  result = GetRepeatDuration();
 
   if (aEnd.IsDefinite()) {
     nsSMILTime activeDur = aEnd.GetMillis() - aBegin.GetMillis();
@@ -1832,29 +1828,25 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,
 nsSMILTimeValue
 nsSMILTimedElement::GetRepeatDuration() const
 {
-  nsSMILTimeValue result;
-
-  if (mRepeatCount.IsDefinite() && mRepeatDur.IsDefinite()) {
-    if (mSimpleDur.IsDefinite()) {
-      nsSMILTime activeDur =
-        nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis()));
-      result.SetMillis(std::min(activeDur, mRepeatDur.GetMillis()));
-    } else {
-      result = mRepeatDur;
-    }
-  } else if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
-    nsSMILTime activeDur =
-      nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis()));
-    result.SetMillis(activeDur);
-  } else if (mRepeatDur.IsDefinite()) {
-    result = mRepeatDur;
-  } else if (mRepeatCount.IsIndefinite()) {
-    result.SetIndefinite();
+  nsSMILTimeValue multipliedDuration;
+  if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
+    multipliedDuration.SetMillis(
+      nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis())));
   } else {
-    result = mSimpleDur;
+    multipliedDuration.SetIndefinite();
   }
 
-  return result;
+  nsSMILTimeValue repeatDuration;
+
+  if (mRepeatDur.IsResolved()) {
+    repeatDuration = std::min(multipliedDuration, mRepeatDur);
+  } else if (mRepeatCount.IsSet()) {
+    repeatDuration = multipliedDuration;
+  } else {
+    repeatDuration = mSimpleDur;
+  }
+
+  return repeatDuration;
 }
 
 nsSMILTimeValue
diff --git a/content/smil/test/mochitest.ini b/content/smil/test/mochitest.ini
index 75d43a4371d7..f208c0e7a81f 100644
--- a/content/smil/test/mochitest.ini
+++ b/content/smil/test/mochitest.ini
@@ -38,6 +38,7 @@ support-files =
 [test_smilMappedAttrFromBy.xhtml]
 [test_smilMappedAttrFromTo.xhtml]
 [test_smilMappedAttrPaced.xhtml]
+[test_smilRepeatDuration.html]
 [test_smilRepeatTiming.xhtml]
 [test_smilReset.xhtml]
 [test_smilRestart.xhtml]
diff --git a/content/smil/test/test_smilRepeatDuration.html b/content/smil/test/test_smilRepeatDuration.html
new file mode 100644
index 000000000000..99a95bb7b88e
--- /dev/null
+++ b/content/smil/test/test_smilRepeatDuration.html
@@ -0,0 +1,139 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=948245
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for repeat duration calculation (Bug 948245)</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank"
+href="https://bugzilla.mozilla.org/show_bug.cgi?id=948245">Mozilla Bug 948245</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<svg id="svg" onload="this.pauseAnimations()">
+  <rect>
+    <animate id="a"/>
+    <animate id="b" begin="a.end"/>
+  </rect>
+</svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+  // Tests the calculation of the repeat duration which is one of the steps
+  // towards determining the active duration.
+  //
+  // The repeat duration is determined by the following three attributes:
+  //
+  // dur:         may be definite (e.g. '2s') or 'indefinite' (the default)
+  // repeatCount: may be definite (e.g. '2.5'), 'indefinite', or not set
+  // repeatDur:   may be definite (e.g. '5s'), 'indefinite', or not set
+  //
+  // That leaves 18 combinations to test.
+  var testCases =
+    [
+      // 1. repeatDur: definite, repeatCount: definite, dur: definite
+      // (Two test cases here to ensure we get the minimum)
+      { repeatDur: 15, repeatCount: 2, dur: 10, result: 15 },
+      { repeatDur: 25, repeatCount: 2, dur: 10, result: 20 },
+      // 2. repeatDur: indefinite, repeatCount: definite, dur: definite
+      { repeatDur: 'indefinite', repeatCount: 2, dur: 10, result: 20 },
+      // 3. repeatDur: not set, repeatCount: definite, dur: definite
+      { repeatCount: 2, dur: 10, result: 20 },
+      // 4. repeatDur: definite, repeatCount: indefinite, dur: definite
+      { repeatDur: 15, repeatCount: 'indefinite', dur: 10, result: 15 },
+      // 5. repeatDur: indefinite, repeatCount: indefinite, dur: definite
+      { repeatDur: 'indefinite', repeatCount: 'indefinite', dur: 10,
+        result: 'indefinite' },
+      // 6. repeatDur: not set, repeatCount: indefinite, dur: definite
+      { repeatCount: 'indefinite', dur: 10, result: 'indefinite' },
+      // 7. repeatDur: definite, repeatCount: not set, dur: definite
+      { repeatDur: 15, dur: 10, result: 15 },
+      // 8. repeatDur: indefinite, repeatCount: not set, dur: definite
+      { repeatDur: 'indefinite', dur: 10, result: 'indefinite' },
+      // 9. repeatDur: not set, repeatCount: not set, dur: definite
+      { dur: 10, result: 10 },
+      // 10. repeatDur: definite, repeatCount: definite, dur: indefinite
+      { repeatDur: 15, repeatCount: 2, dur: 'indefinite', result: 15 },
+      // 11. repeatDur: indefinite, repeatCount: definite, dur: indefinite
+      { repeatDur: 'indefinite', repeatCount: 2, dur: 'indefinite',
+        result: 'indefinite' },
+      // 12. repeatDur: not set, repeatCount: definite, dur: indefinite
+      { repeatCount: 2, dur: 'indefinite', result: 'indefinite' },
+      // 13. repeatDur: definite, repeatCount: indefinite, dur: indefinite
+      { repeatDur: 15, repeatCount: 'indefinite', dur: 'indefinite',
+        result: 15 },
+      // 14. repeatDur: indefinite, repeatCount: indefinite, dur: indefinite
+      { repeatDur: 'indefinite', repeatCount: 'indefinite', dur: 'indefinite',
+        result: 'indefinite' },
+      // 15. repeatDur: not set, repeatCount: indefinite, dur: indefinite
+      { repeatCount: 'indefinite', dur: 'indefinite', result: 'indefinite' },
+      // 16. repeatDur: definite, repeatCount: not set, dur: indefinite
+      { repeatDur: 15, dur: 'indefinite', result: 15 },
+      // 17. repeatDur: indefinite, repeatCount: not set, dur: indefinite
+      { repeatDur: 'indefinite', dur: 'indefinite', result: 'indefinite' },
+      // 18. repeatDur: not set, repeatCount: not set, dur: indefinite
+      { dur: 'indefinite', result: 'indefinite' }
+    ];
+
+  // We can test the repeat duration by setting these attributes on animation
+  // 'a' and checking the start time of 'b' which is defined to start when 'a'
+  // finishes.
+  //
+  // Since 'a' has no end/min/max attributes the end of its active interval
+  // should coincide with the end of its repeat duration.
+  //
+  // Sometimes the repeat duration is defined to be 'indefinite'. In this case
+  // calling getStartTime on b will throw an exception so we need to catch that
+  // exception and translate it to 'indefinite' as follows:
+  function getRepeatDuration() {
+    try {
+      return $('b').getStartTime();
+    } catch(e) {
+      if (e.name == "InvalidStateError" &&
+          e.code == DOMException.INVALID_STATE_ERR) {
+        return 'indefinite';
+      } else {
+        ok(false, "Unexpected exception: " + e);
+        return null;
+      }
+    }
+  }
+
+  // Animation doesn't start until onload
+  SimpleTest.waitForExplicitFinish();
+  window.addEventListener("load", runTests, false);
+
+  // Run through each of the test cases
+  function runTests() {
+    ok($('svg').animationsPaused(), "should be paused by <svg> load handler");
+
+    testCases.forEach(function(test) {
+      var a = $('a');
+
+      // Set the attributes
+      var msgPieces = [];
+      [ 'repeatDur', 'repeatCount', 'dur' ].forEach(function(attr) {
+        if (typeof test[attr] != "undefined") {
+          a.setAttribute(attr, test[attr].toString());
+          msgPieces.push(attr + ': ' + test[attr].toString());
+        } else {
+          a.removeAttribute(attr);
+          msgPieces.push(attr + ': <not set>');
+        }
+      });
+      var msg = msgPieces.join(', ');
+
+      // Check the result
+      ise(getRepeatDuration(), test.result, msg);
+    });
+
+    SimpleTest.finish();
+  }
+</script>
+</pre>
+</body>
+</html>

From 11ce2f85048d55de49c7d7e49ff48f84ec0daece Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Fri, 13 Dec 2013 13:41:52 +0900
Subject: [PATCH 010/144] Bug 948245 part 2 - Allow the min attribute to extend
 the active duration; r=dholbert

The min attribute on an animation element can extend the active duration making
it longer than the "repeat duration" (the amount of the time the animation runs
including all repeats). For the remaining time after the repeat duration has
completed until the end of the active duration the animation should apply its
fill behavior.

Previously this was not implemented and min could not extend the active
duration. Allowing this effectively introduces an additional kind of state where
we are both within the active interval but not animating. In this case we
set the animation function (referred to as the "client" for historical reasons)
to inactive so that effectively the timing model is active but the animation
model is inactive.

(In the future we will come up with something a little easier to understand when
we rework this in terms of Web Animations components.)
---
 content/smil/nsSMILAnimationFunction.h    |   9 ++
 content/smil/nsSMILTimedElement.cpp       | 103 +++++++++++++++-------
 content/smil/nsSMILTimedElement.h         |   1 +
 content/smil/test/mochitest.ini           |   1 +
 content/smil/test/test_smilMinTiming.html |  93 +++++++++++++++++++
 layout/reftests/svg/smil/min-1.svg        |  24 +++++
 layout/reftests/svg/smil/reftest.list     |   2 +
 7 files changed, 202 insertions(+), 31 deletions(-)
 create mode 100644 content/smil/test/test_smilMinTiming.html
 create mode 100644 layout/reftests/svg/smil/min-1.svg

diff --git a/content/smil/nsSMILAnimationFunction.h b/content/smil/nsSMILAnimationFunction.h
index 3f233758ac0c..27f4e6f20cb3 100644
--- a/content/smil/nsSMILAnimationFunction.h
+++ b/content/smil/nsSMILAnimationFunction.h
@@ -164,6 +164,15 @@ public:
     return (mIsActive || mIsFrozen);
   }
 
+  /**
+   * Indicates if the animation is active.
+   *
+   * @return  true if the animation is active, false otherwise.
+   */
+  bool IsActive() const {
+    return mIsActive;
+  }
+
   /**
    * Indicates if this animation will replace the passed in result rather than
    * adding to it. Animations that replace the underlying value may be called
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 4ffde26796ed..0da19cdbf412 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -667,19 +667,32 @@ nsSMILTimedElement::DoSampleAt(nsSMILTime aContainerTime, bool aEndOnly)
           NS_ASSERTION(aContainerTime >= beginTime,
                        "Sample time should not precede current interval");
           nsSMILTime activeTime = aContainerTime - beginTime;
-          SampleSimpleTime(activeTime);
-          // We register our repeat times as milestones (except when we're
-          // seeking) so we should get a sample at exactly the time we repeat.
-          // (And even when we are seeking we want to update
-          // mCurrentRepeatIteration so we do that first before testing the seek
-          // state.)
-          uint32_t prevRepeatIteration = mCurrentRepeatIteration;
-          if (ActiveTimeToSimpleTime(activeTime, mCurrentRepeatIteration)==0 &&
+
+          // The 'min' attribute can cause the active interval to be longer than
+          // the 'repeating interval'.
+          // In that extended period we apply the fill mode.
+          if (GetRepeatDuration() <= nsSMILTimeValue(activeTime)) {
+            if (mClient && mClient->IsActive()) {
+              mClient->Inactivate(mFillMode == FILL_FREEZE);
+            }
+            SampleFillValue();
+          } else {
+            SampleSimpleTime(activeTime);
+
+            // We register our repeat times as milestones (except when we're
+            // seeking) so we should get a sample at exactly the time we repeat.
+            // (And even when we are seeking we want to update
+            // mCurrentRepeatIteration so we do that first before testing the
+            // seek state.)
+            uint32_t prevRepeatIteration = mCurrentRepeatIteration;
+            if (
+              ActiveTimeToSimpleTime(activeTime, mCurrentRepeatIteration)==0 &&
               mCurrentRepeatIteration != prevRepeatIteration &&
               mCurrentRepeatIteration &&
               mSeekState == SEEK_NOT_SEEKING) {
-            FireTimeEventAsync(NS_SMIL_REPEAT,
-                          static_cast<int32_t>(mCurrentRepeatIteration));
+              FireTimeEventAsync(NS_SMIL_REPEAT,
+                            static_cast<int32_t>(mCurrentRepeatIteration));
+            }
           }
         }
       }
@@ -1084,12 +1097,8 @@ nsSMILTimedElement::SetFillMode(const nsAString& aFillModeSpec)
             ? nsSMILFillMode(temp.GetEnumValue())
             : FILL_REMOVE;
 
-  // Check if we're in a fill-able state: i.e. we've played at least one
-  // interval and are now between intervals or at the end of all intervals
-  bool isFillable = HasPlayed() &&
-    (mElementState == STATE_WAITING || mElementState == STATE_POSTACTIVE);
-
-  if (mClient && mFillMode != previousFillMode && isFillable) {
+  // Update fill mode of client
+  if (mFillMode != previousFillMode && HasClientInFillRange()) {
     mClient->Inactivate(mFillMode == FILL_FREEZE);
     SampleFillValue();
   }
@@ -1102,9 +1111,9 @@ nsSMILTimedElement::UnsetFillMode()
 {
   uint16_t previousFillMode = mFillMode;
   mFillMode = FILL_REMOVE;
-  if ((mElementState == STATE_WAITING || mElementState == STATE_POSTACTIVE) &&
-      previousFillMode == FILL_FREEZE && mClient && HasPlayed())
+  if (previousFillMode == FILL_FREEZE && HasClientInFillRange()) {
     mClient->Inactivate(false);
+  }
 }
 
 void
@@ -1865,8 +1874,7 @@ nsSMILTimedElement::ApplyMinAndMax(const nsSMILTimeValue& aDuration) const
   if (aDuration > mMax) {
     result = mMax;
   } else if (aDuration < mMin) {
-    nsSMILTimeValue repeatDur = GetRepeatDuration();
-    result = mMin > repeatDur ? repeatDur : mMin;
+    result = mMin;
   } else {
     result = aDuration;
   }
@@ -2060,16 +2068,35 @@ nsSMILTimedElement::SampleFillValue()
   if (mFillMode != FILL_FREEZE || !mClient)
     return;
 
-  const nsSMILInterval* prevInterval = GetPreviousInterval();
-  NS_ABORT_IF_FALSE(prevInterval,
-      "Attempting to sample fill value but there is no previous interval");
-  NS_ABORT_IF_FALSE(prevInterval->End()->Time().IsDefinite() &&
-      prevInterval->End()->IsFixedTime(),
-      "Attempting to sample fill value but the endpoint of the previous "
-      "interval is not resolved and fixed");
+  nsSMILTime activeTime;
 
-  nsSMILTime activeTime = prevInterval->End()->Time().GetMillis() -
-                          prevInterval->Begin()->Time().GetMillis();
+  if (mElementState == STATE_WAITING || mElementState == STATE_POSTACTIVE) {
+    const nsSMILInterval* prevInterval = GetPreviousInterval();
+    NS_ABORT_IF_FALSE(prevInterval,
+        "Attempting to sample fill value but there is no previous interval");
+    NS_ABORT_IF_FALSE(prevInterval->End()->Time().IsDefinite() &&
+        prevInterval->End()->IsFixedTime(),
+        "Attempting to sample fill value but the endpoint of the previous "
+        "interval is not resolved and fixed");
+
+    activeTime = prevInterval->End()->Time().GetMillis() -
+                 prevInterval->Begin()->Time().GetMillis();
+
+    // If the interval's repeat duration was shorter than its active duration,
+    // use the end of the repeat duration to determine the frozen animation's
+    // state.
+    nsSMILTimeValue repeatDuration = GetRepeatDuration();
+    if (repeatDuration.IsDefinite()) {
+      activeTime = std::min(repeatDuration.GetMillis(), activeTime);
+    }
+  } else if (mElementState == STATE_ACTIVE) {
+    // If we are being asked to sample the fill value while active we *must*
+    // have a repeat duration shorter than the active duration so use that.
+    MOZ_ASSERT(GetRepeatDuration().IsDefinite(),
+        "Attempting to sample fill value of an active animation with "
+        "an indefinite repeat duration");
+    activeTime = GetRepeatDuration().GetMillis();
+  }
 
   uint32_t repeatIteration;
   nsSMILTime simpleTime =
@@ -2165,8 +2192,13 @@ nsSMILTimedElement::GetNextMilestone(nsSMILMilestone& aNextMilestone) const
       // Work out what comes next: the interval end or the next repeat iteration
       nsSMILTimeValue nextRepeat;
       if (mSeekState == SEEK_NOT_SEEKING && mSimpleDur.IsDefinite()) {
-        nextRepeat.SetMillis(mCurrentInterval->Begin()->Time().GetMillis() +
-            (mCurrentRepeatIteration + 1) * mSimpleDur.GetMillis());
+        nsSMILTime nextRepeatActiveTime =
+          (mCurrentRepeatIteration + 1) * mSimpleDur.GetMillis();
+        // Check that the repeat fits within the repeat duration
+        if (nsSMILTimeValue(nextRepeatActiveTime) < GetRepeatDuration()) {
+          nextRepeat.SetMillis(mCurrentInterval->Begin()->Time().GetMillis() +
+                               nextRepeatActiveTime);
+        }
       }
       nsSMILTimeValue nextMilestone =
         std::min(mCurrentInterval->End()->Time(), nextRepeat);
@@ -2275,6 +2307,15 @@ nsSMILTimedElement::GetPreviousInterval() const
     : mOldIntervals[mOldIntervals.Length()-1].get();
 }
 
+bool
+nsSMILTimedElement::HasClientInFillRange() const
+{
+  // Returns true if we have a client that is in the range where it will fill
+  return mClient &&
+         ((mElementState != STATE_ACTIVE && HasPlayed()) ||
+          (mElementState == STATE_ACTIVE && !mClient->IsActive()));
+}
+
 bool
 nsSMILTimedElement::EndHasEventConditions() const
 {
diff --git a/content/smil/nsSMILTimedElement.h b/content/smil/nsSMILTimedElement.h
index c97ff7bd0b62..2b905499f96a 100644
--- a/content/smil/nsSMILTimedElement.h
+++ b/content/smil/nsSMILTimedElement.h
@@ -512,6 +512,7 @@ protected:
   const nsSMILInstanceTime* GetEffectiveBeginInstance() const;
   const nsSMILInterval* GetPreviousInterval() const;
   bool              HasPlayed() const { return !mOldIntervals.IsEmpty(); }
+  bool              HasClientInFillRange() const;
   bool              EndHasEventConditions() const;
   bool              AreEndTimesDependentOn(
                       const nsSMILInstanceTime* aBase) const;
diff --git a/content/smil/test/mochitest.ini b/content/smil/test/mochitest.ini
index f208c0e7a81f..02b724f0a50e 100644
--- a/content/smil/test/mochitest.ini
+++ b/content/smil/test/mochitest.ini
@@ -38,6 +38,7 @@ support-files =
 [test_smilMappedAttrFromBy.xhtml]
 [test_smilMappedAttrFromTo.xhtml]
 [test_smilMappedAttrPaced.xhtml]
+[test_smilMinTiming.html]
 [test_smilRepeatDuration.html]
 [test_smilRepeatTiming.xhtml]
 [test_smilReset.xhtml]
diff --git a/content/smil/test/test_smilMinTiming.html b/content/smil/test/test_smilMinTiming.html
new file mode 100644
index 000000000000..e336d0f9aca6
--- /dev/null
+++ b/content/smil/test/test_smilMinTiming.html
@@ -0,0 +1,93 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=948245
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 948245</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=948245">Mozilla Bug 948245</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<svg id="svg" onload="this.pauseAnimations()">
+  <rect fill="red" id="rect" x="0">
+    <animate attributeName="x" to="100" id="animation" dur="100s" min="200s"/>
+  </rect>
+</svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+  // The 'min' attribute introduces a kind of additional state into the SMIL
+  // model. If the 'min' attribute extends the active duration, the additional
+  // time between the amount of time the animation normally runs for (called the
+  // 'repeat duration') and the extended active duration is filled using the
+  // fill mode.
+  //
+  // Below we refer to this period of time between the end of the repeat
+  // duration and the end of the active duration as the 'extended period'.
+  //
+  // This test verifies that as we jump in and out of these states we produce
+  // the correct values.
+  //
+  // The test animation above produces an active interval that is longer than
+  // the 'repeating duration' of the animation.
+  var rect      = $('rect'),
+      animation = $('animation');
+
+  // Animation doesn't start until onload
+  SimpleTest.waitForExplicitFinish();
+  window.addEventListener("load", runTests, false);
+
+  function runTests() {
+    ok($('svg').animationsPaused(), "should be paused by <svg> load handler");
+
+    // In the extended period (t=150s) we should not be animating or filling
+    // since the default fill mode is "none".
+    animation.ownerSVGElement.setCurrentTime(150);
+    ise(rect.x.animVal.value, 0,
+        "Shouldn't fill in extended period with fill='none'");
+
+    // If we set the fill mode we should start filling.
+    animation.setAttribute("fill", "freeze");
+    ise(rect.x.animVal.value, 100,
+        "Should fill in extended period with fill='freeze'");
+
+    // If we unset the fill attribute we should stop filling.
+    animation.removeAttribute("fill");
+    ise(rect.x.animVal.value, 0, "Shouldn't fill after unsetting fill");
+
+    // If we jump back into the repeated interval (at t=50s) we should be
+    // animating.
+    animation.ownerSVGElement.setCurrentTime(50);
+    ise(rect.x.animVal.value, 50, "Should be active in repeating interval");
+
+    // If we jump to the boundary at the start of the extended period we should
+    // not be filling (since we removed the fill attribute above).
+    animation.ownerSVGElement.setCurrentTime(100);
+    ise(rect.x.animVal.value, 0,
+        "Shouldn't fill after seeking to boundary of extended period");
+
+    // If we apply a fill mode at this boundary point we should do regular fill
+    // behavior of using the last value in the interpolation range.
+    animation.setAttribute("fill", "freeze");
+    ise(rect.x.animVal.value, 100,
+        "Should fill at boundary to extended period");
+
+    // Check that if we seek past the interval we fill with the value at the end
+    // of the _repeat_duration_ not the value at the end of the
+    // _active_duration_.
+    animation.setAttribute("repeatCount", "1.5");
+    animation.ownerSVGElement.setCurrentTime(225);
+    ise(rect.x.animVal.value, 50,
+        "Should fill with the end of the repeat duration value");
+
+    SimpleTest.finish();
+  }
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/reftests/svg/smil/min-1.svg b/layout/reftests/svg/smil/min-1.svg
new file mode 100644
index 000000000000..6ba576d45213
--- /dev/null
+++ b/layout/reftests/svg/smil/min-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait"
+     onload="setTimeAndSnapshot(115, true)">
+  <script xlink:href="smil-util.js" type="text/javascript"/>
+  <!-- Test min behavior
+
+       Set up is as follows:
+       1. There is a rectangle with a lime fill.
+       2. A <set> animation (with default fill="none") sets the fill to
+          orange at t=100s.
+          It has a simple duration of 10s and a min duration of 20s.
+       3. A further <set> animation sets the fill to red when the first
+          animation finishes (using syncbase timing).
+
+       At time t=115s we should still be in the first animation's active
+       interval with its fill mode of 'none' applied which should mean the
+       original lime fill is used. -->
+  <rect width="100%" height="100%" fill="lime">
+    <set attributeName="fill" to="orange" dur="10s" min="20s" begin="100s"
+      id="a"/>
+    <set attributeName="fill" to="red" begin="a.end"/>
+  </rect>
+</svg>
diff --git a/layout/reftests/svg/smil/reftest.list b/layout/reftests/svg/smil/reftest.list
index e58d9273220a..9f1ba4e80c28 100644
--- a/layout/reftests/svg/smil/reftest.list
+++ b/layout/reftests/svg/smil/reftest.list
@@ -251,6 +251,8 @@ fuzzy-if(cocoaWidget&&layersGPUAccelerated,1,2) == anim-gradient-attr-presence-0
 # interaction between xml mapped attributes and their css equivalents
 == mapped-attr-vs-css-prop-1.svg lime.svg
 
+== min-1.svg lime.svg
+
 == smil-transitions-interaction-1a.svg lime.svg
 == smil-transitions-interaction-1b.svg lime.svg
 == smil-transitions-interaction-2a.svg lime.svg

From 0de483c99ecbe1cbbd1f72972227daf430142050 Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Fri, 13 Dec 2013 13:41:56 +0900
Subject: [PATCH 011/144] Bug 941315 - Update the timing model even when
 invalid values are set; r=longsonr

When an invalid dur, min, max, or repeatDur is set we were failing to call
UpdateCurrentInterval to update the timing model. This patch makes sure we
update the current interval in error cases too.

Mochitests test the interval is being updated in these cases and, for
completeness, the case of repeatCount as well.
---
 content/smil/nsSMILTimedElement.cpp           |  54 +++++++--
 content/smil/nsSMILTimedElement.h             |   3 +
 content/smil/test/mochitest.ini               |   1 +
 content/smil/test/test_smilInvalidValues.html | 113 ++++++++++++++++++
 4 files changed, 160 insertions(+), 11 deletions(-)
 create mode 100644 content/smil/test/test_smilInvalidValues.html

diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 0da19cdbf412..db6f05975a9e 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -112,8 +112,9 @@ namespace
 //----------------------------------------------------------------------
 // Helper class: AutoIntervalUpdateBatcher
 
-// RAII helper to set the mDeferIntervalUpdates flag on an nsSMILTimedElement
-// and perform the UpdateCurrentInterval when the object is destroyed.
+// Stack-based helper class to set the mDeferIntervalUpdates flag on an
+// nsSMILTimedElement and perform the UpdateCurrentInterval when the object is
+// destroyed.
 //
 // If several of these objects are allocated on the stack, the update will not
 // be performed until the last object for a given nsSMILTimedElement is
@@ -146,6 +147,31 @@ private:
   bool mDidSetFlag;
 };
 
+//----------------------------------------------------------------------
+// Helper class: AutoIntervalUpdater
+
+// Stack-based helper class to call UpdateCurrentInterval when it is destroyed
+// which helps avoid bugs where we forget to call UpdateCurrentInterval in the
+// case of early returns (e.g. due to parse errors).
+//
+// This can be safely used in conjunction with AutoIntervalUpdateBatcher; any
+// calls to UpdateCurrentInterval made by this class will simply be deferred if
+// there is an AutoIntervalUpdateBatcher on the stack.
+class MOZ_STACK_CLASS nsSMILTimedElement::AutoIntervalUpdater
+{
+public:
+  AutoIntervalUpdater(nsSMILTimedElement& aTimedElement)
+    : mTimedElement(aTimedElement) { }
+
+  ~AutoIntervalUpdater()
+  {
+    mTimedElement.UpdateCurrentInterval();
+  }
+
+private:
+  nsSMILTimedElement& mTimedElement;
+};
+
 //----------------------------------------------------------------------
 // Templated helper functions
 
@@ -918,8 +944,10 @@ nsSMILTimedElement::UnsetEndSpec(RemovalTestFunction aRemove)
 nsresult
 nsSMILTimedElement::SetSimpleDuration(const nsAString& aDurSpec)
 {
-  nsSMILTimeValue duration;
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
 
+  nsSMILTimeValue duration;
   const nsAString& dur = nsSMILParserUtils::TrimWhitespace(aDurSpec);
 
   // SVG-specific: "For SVG's animation elements, if "media" is specified, the
@@ -939,7 +967,6 @@ nsSMILTimedElement::SetSimpleDuration(const nsAString& aDurSpec)
     "Setting unresolved simple duration");
 
   mSimpleDur = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
@@ -954,8 +981,10 @@ nsSMILTimedElement::UnsetSimpleDuration()
 nsresult
 nsSMILTimedElement::SetMin(const nsAString& aMinSpec)
 {
-  nsSMILTimeValue duration;
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
 
+  nsSMILTimeValue duration;
   const nsAString& min = nsSMILParserUtils::TrimWhitespace(aMinSpec);
 
   if (min.EqualsLiteral("media")) {
@@ -970,7 +999,6 @@ nsSMILTimedElement::SetMin(const nsAString& aMinSpec)
   NS_ABORT_IF_FALSE(duration.GetMillis() >= 0L, "Invalid duration");
 
   mMin = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
@@ -985,8 +1013,10 @@ nsSMILTimedElement::UnsetMin()
 nsresult
 nsSMILTimedElement::SetMax(const nsAString& aMaxSpec)
 {
-  nsSMILTimeValue duration;
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
 
+  nsSMILTimeValue duration;
   const nsAString& max = nsSMILParserUtils::TrimWhitespace(aMaxSpec);
 
   if (max.EqualsLiteral("media") || max.EqualsLiteral("indefinite")) {
@@ -1001,7 +1031,6 @@ nsSMILTimedElement::SetMax(const nsAString& aMaxSpec)
   }
 
   mMax = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
@@ -1036,15 +1065,16 @@ nsSMILTimedElement::UnsetRestart()
 nsresult
 nsSMILTimedElement::SetRepeatCount(const nsAString& aRepeatCountSpec)
 {
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
+
   nsSMILRepeatCount newRepeatCount;
 
   if (nsSMILParserUtils::ParseRepeatCount(aRepeatCountSpec, newRepeatCount)) {
     mRepeatCount = newRepeatCount;
-    UpdateCurrentInterval();
     return NS_OK;
   }
   mRepeatCount.Unset();
-  UpdateCurrentInterval();
   return NS_ERROR_FAILURE;
 }
 
@@ -1058,6 +1088,9 @@ nsSMILTimedElement::UnsetRepeatCount()
 nsresult
 nsSMILTimedElement::SetRepeatDur(const nsAString& aRepeatDurSpec)
 {
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
+
   nsSMILTimeValue duration;
 
   const nsAString& repeatDur =
@@ -1073,7 +1106,6 @@ nsSMILTimedElement::SetRepeatDur(const nsAString& aRepeatDurSpec)
   }
 
   mRepeatDur = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
diff --git a/content/smil/nsSMILTimedElement.h b/content/smil/nsSMILTimedElement.h
index 2b905499f96a..a8086acb8c52 100644
--- a/content/smil/nsSMILTimedElement.h
+++ b/content/smil/nsSMILTimedElement.h
@@ -616,6 +616,9 @@ protected:
   bool mDoDeferredUpdate; // Set if an update to the current interval was
                           // requested while mDeferIntervalUpdates was set
 
+  // Stack-based helper class to call UpdateCurrentInterval when it is destroyed
+  class AutoIntervalUpdater;
+
   // Recursion depth checking
   uint8_t              mDeleteCount;
   uint8_t              mUpdateIntervalRecursionDepth;
diff --git a/content/smil/test/mochitest.ini b/content/smil/test/mochitest.ini
index 02b724f0a50e..c48b6f4330c7 100644
--- a/content/smil/test/mochitest.ini
+++ b/content/smil/test/mochitest.ini
@@ -32,6 +32,7 @@ support-files =
 [test_smilGetSimpleDuration.xhtml]
 [test_smilGetStartTime.xhtml]
 [test_smilHyperlinking.xhtml]
+[test_smilInvalidValues.html]
 [test_smilKeySplines.xhtml]
 [test_smilKeyTimes.xhtml]
 [test_smilKeyTimesPacedMode.xhtml]
diff --git a/content/smil/test/test_smilInvalidValues.html b/content/smil/test/test_smilInvalidValues.html
new file mode 100644
index 000000000000..c24761c03efb
--- /dev/null
+++ b/content/smil/test/test_smilInvalidValues.html
@@ -0,0 +1,113 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=941315
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test invalid values cause the model to be updated (bug 941315)</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=941315">Mozilla Bug 941315</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<svg width="100%" height="1" onload="this.pauseAnimations()">
+  <rect>
+    <animate id="a" dur="100s"/>
+    <animate id="b" dur="5s" begin="a.end"/>
+  </rect>
+  <circle cx="-100" cy="20" r="15" fill="blue" id="circle"/>
+</svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+  var a = $('a'),
+      b = $('b');
+
+  // Animation doesn't start until onload
+  SimpleTest.waitForExplicitFinish();
+  window.addEventListener("load", runTests, false);
+
+  // Make testing getStartTime easier
+  SVGAnimationElement.prototype.safeGetStartTime = function() {
+    try {
+      return this.getStartTime();
+    } catch(e) {
+      if (e.name == "InvalidStateError" &&
+          e.code == DOMException.INVALID_STATE_ERR) {
+        return 'none';
+      } else {
+        ok(false, "Unexpected exception: " + e);
+        return null;
+      }
+    }
+  };
+
+  function runTests() {
+    [testSimpleDuration, testMin, testMax, testRepeatDur, testRepeatCount]
+      .forEach(function(test) {
+        ise(b.getStartTime(), 100, "initial state before running " + test.name);
+        test();
+        ise(b.getStartTime(), 100, "final state after running " + test.name);
+      });
+    SimpleTest.finish();
+  }
+
+  function testSimpleDuration() {
+    // Verify a valid value updates as expected
+    a.setAttribute("dur", "50s");
+    ise(b.safeGetStartTime(), 50, "valid simple duration");
+
+    // Check an invalid value also causes the model to be updated
+    a.setAttribute("dur", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), "none", "invalid simple duration");
+
+    // Restore state
+    a.setAttribute("dur", "100s");
+  }
+
+  function testMin() {
+    a.setAttribute("min", "200s");
+    ise(b.safeGetStartTime(), 200, "valid min duration");
+
+    a.setAttribute("min", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid min duration");
+
+    a.removeAttribute("min");
+  }
+
+  function testMax() {
+    a.setAttribute("max", "50s");
+    ise(b.safeGetStartTime(), 50, "valid max duration");
+
+    a.setAttribute("max", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid max duration");
+
+    a.removeAttribute("max");
+  }
+
+  function testRepeatDur() {
+    a.setAttribute("repeatDur", "200s");
+    ise(b.safeGetStartTime(), 200, "valid repeatDur duration");
+
+    a.setAttribute("repeatDur", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid repeatDur duration");
+
+    a.removeAttribute("repeatDur");
+  }
+
+  function testRepeatCount() {
+    a.setAttribute("repeatCount", "2");
+    ise(b.safeGetStartTime(), 200, "valid repeatCount duration");
+
+    a.setAttribute("repeatCount", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid repeatCount duration");
+
+    a.removeAttribute("repeatCount");
+  }
+</script>
+</pre>
+</body>
+</html>

From c2a5a16255ef8a7293281f8b390e4162fe92b34b Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:16:14 -0800
Subject: [PATCH 012/144] Bug 940765 - preference service can GC, r=terrence

--HG--
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1-ref.xhtml
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1.xhtml
extra : rebase_source : cad260c0819a3ced47e1ec612de2788e1e991670
---
 js/src/devtools/rootAnalysis/annotations.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 1803eb87f5a2..08267463757e 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -160,10 +160,6 @@ var ignoreFunctions = {
     // FIXME!
     "NS_DebugBreak": true,
 
-    // Bug 940765 - fetching preferences should not GC
-    "PrefHashEntry* pref_HashTableLookup(void*)": true,
-    "uint8 mozilla::Preferences::InitStaticMembers()": true, // Temporary, see bug 940765
-
     // These are a little overzealous -- these destructors *can* GC if they end
     // up wrapping a pending exception. See bug 898815 for the heavyweight fix.
     "void js::AutoCompartment::~AutoCompartment(int32)" : true,

From 6adc5e5233e69327afa3eb37610055ce53e63f03 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:16:47 -0800
Subject: [PATCH 013/144] Bug 948646 - AutoJSContext cannot GC, r=terrence

--HG--
extra : rebase_source : f015f6bce00faa2c8e77cb861ed0770710e718ed
---
 js/src/devtools/rootAnalysis/annotations.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 08267463757e..530e489bdf3d 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -165,6 +165,13 @@ var ignoreFunctions = {
     "void js::AutoCompartment::~AutoCompartment(int32)" : true,
     "void JSAutoCompartment::~JSAutoCompartment(int32)" : true,
 
+    // Bug 948646 - the only thing AutoJSContext's constructor calls
+    // is an Init() routine whose entire body is covered with an
+    // AutoAssertNoGC. AutoSafeJSContext is the same thing, just with
+    // a different value for the 'aSafe' parameter.
+    "void mozilla::AutoJSContext::AutoJSContext(mozilla::detail::GuardObjectNotifier*)" : true,
+    "void mozilla::AutoSafeJSContext::~AutoSafeJSContext(int32)" : true,
+
     // And these are workarounds to avoid even more analysis work,
     // which would sadly still be needed even with bug 898815.
     "void js::AutoCompartment::AutoCompartment(js::ExclusiveContext*, JSCompartment*)": true,

From 89d34ffe587efae024fd1b1306ffc4149508560c Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:17:14 -0800
Subject: [PATCH 014/144] Bug 948753 - Annotate sane nsISupports virtual
 methods, r=bhackett

--HG--
extra : rebase_source : 85695549d5d068bd393fc50e7190da00f95970ca
---
 js/src/devtools/rootAnalysis/annotations.js     | 14 ++++++++++++++
 .../devtools/rootAnalysis/computeCallgraph.js   | 17 ++++++++++-------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 530e489bdf3d..d2e479eb018c 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -235,3 +235,17 @@ function isSuppressConstructor(name)
         || /::AutoEnterAnalysis/.test(name)
         || /::AutoAssertNoGC/.test(name);
 }
+
+// nsISupports subclasses' methods may be scriptable (or overridden
+// via binary XPCOM), and so may GC. But some fields just aren't going
+// to get overridden with something that can GC.
+function isOverridableField(csu, field)
+{
+    if (csu != 'nsISupports')
+        return false;
+    if (field == 'GetCurrentJSContext')
+        return false;
+    if (field == 'IsOnCurrentThread')
+        return false;
+    return true;
+}
diff --git a/js/src/devtools/rootAnalysis/computeCallgraph.js b/js/src/devtools/rootAnalysis/computeCallgraph.js
index 3b66de0a6045..493cb54e173a 100644
--- a/js/src/devtools/rootAnalysis/computeCallgraph.js
+++ b/js/src/devtools/rootAnalysis/computeCallgraph.js
@@ -61,13 +61,13 @@ function findVirtualFunctions(csu, field, suppressed)
     // which should never enter the JS engine (even when calling dtors).
     while (worklist.length) {
         var csu = worklist.pop();
-        if (csu == "nsISupports") {
-            if (field == "AddRef" || field == "Release") {
-                suppressed[0] = true;
-                return [];
-            }
-            return null;
+        if (csu == "nsISupports" && (field == "AddRef" || field == "Release")) {
+            suppressed[0] = true;
+            return [];
         }
+        if (isOverridableField(csu, field))
+            return null;
+
         if (csu in superclasses) {
             for (var superclass of superclasses[csu])
                 worklist.push(superclass);
@@ -258,6 +258,8 @@ for (var csuIndex = minStream; csuIndex <= maxStream; csuIndex++) {
 
 xdb.open("src_body.xdb");
 
+printErr("Finished loading data structures");
+
 var minStream = xdb.min_data_stream();
 var maxStream = xdb.max_data_stream();
 
@@ -275,8 +277,9 @@ for (var nameIndex = minStream; nameIndex <= maxStream; nameIndex++) {
     seenCallees = {};
     seenSuppressedCallees = {};
 
+    var functionName = name.readString();
     for (var body of functionBodies)
-        processBody(name.readString(), body);
+        processBody(functionName, body);
 
     xdb.free_string(name);
     xdb.free_string(data);

From 2a86d8d7e6d707e37347fe2bc1e850b75c827e71 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:17:17 -0800
Subject: [PATCH 015/144] No bug. Remove noisy debugging printout.

--HG--
extra : rebase_source : f5aa45dcb6c5d051f8888682d3aeab71b7df56d5
---
 js/src/devtools/rootAnalysis/loadCallgraph.js | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/loadCallgraph.js b/js/src/devtools/rootAnalysis/loadCallgraph.js
index 80216a1258b3..295d3f9ce7ce 100644
--- a/js/src/devtools/rootAnalysis/loadCallgraph.js
+++ b/js/src/devtools/rootAnalysis/loadCallgraph.js
@@ -148,9 +148,7 @@ function loadCallgraph(file)
     // Any field call that has been resolved to all possible callees can be
     // trusted to not GC if all of those callees are known to not GC.
     for (var name in resolvedFunctions) {
-        if (!(name in gcFunctions)) {
+        if (!(name in gcFunctions))
             suppressedFunctions[name] = true;
-            printErr("Adding " + name);
-        }
     }
 }

From 3e95adf082f60705ac613efdd57834f9af0acc6a Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Wed, 11 Dec 2013 21:24:13 -0800
Subject: [PATCH 016/144] Bug 949324 - Fix -Wunused-function warnings in js/.
 r=luke

---
 js/src/jit/IonMacroAssembler.cpp | 2 +-
 js/src/shell/js.cpp              | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index c68c9de5ffa5..a0511b1c653c 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -1213,12 +1213,12 @@ IsCompilingAsmJS()
     IonContext *ictx = MaybeGetIonContext();
     return ictx && ictx->compartment == nullptr;
 }
-#endif
 
 static void
 AssumeUnreachable_(const char *output) {
     MOZ_ReportAssertionFailure(output, __FILE__, __LINE__);
 }
+#endif
 
 void
 MacroAssembler::assumeUnreachable(const char *output)
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 501bc02295ff..594de924ed93 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3591,13 +3591,17 @@ EscapeForShell(AutoCStringVector &argv)
 }
 #endif
 
-Vector<const char*, 4, js::SystemAllocPolicy> sPropagatedFlags;
+static Vector<const char*, 4, js::SystemAllocPolicy> sPropagatedFlags;
 
+#ifdef DEBUG
+#if (defined(JS_CPU_X86) || defined(JS_CPU_X64)) && defined(JS_ION)
 static bool
 PropagateFlagToNestedShells(const char *flag)
 {
     return sPropagatedFlags.append(flag);
 }
+#endif
+#endif
 
 static bool
 NestedShell(JSContext *cx, unsigned argc, jsval *vp)

From 8c13061a4015001d2fd988359b8f2099e4191173 Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Wed, 11 Dec 2013 21:13:24 -0800
Subject: [PATCH 017/144] Bug 949353 - Fix -Wsometimes-uninitialized warnings
 in dom/workers/WorkerPrivate.cpp. r=khuey

---
 dom/workers/WorkerPrivate.cpp | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 67a65c071ea7..f89f14a88165 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -1208,7 +1208,7 @@ public:
         JS::Rooted<JSObject*> target(aCx, JS::CurrentGlobalOrNull(aCx));
         NS_ASSERTION(target, "This should never be null!");
 
-        bool preventDefaultCalled;
+        nsEventStatus status = nsEventStatus_eIgnore;
         nsIScriptGlobalObject* sgo;
 
         if (aWorkerPrivate) {
@@ -1222,15 +1222,12 @@ public:
           event.fileName = aFilename.get();
           event.typeString = NS_LITERAL_STRING("error");
 
-          nsEventStatus status = nsEventStatus_eIgnore;
           nsIDOMEventTarget* target = static_cast<nsIDOMEventTarget*>(globalTarget);
           if (NS_FAILED(nsEventDispatcher::Dispatch(target, nullptr, &event,
                                                     nullptr, &status))) {
             NS_WARNING("Failed to dispatch worker thread error event!");
             status = nsEventStatus_eIgnore;
           }
-
-          preventDefaultCalled = status == nsEventStatus_eConsumeNoDefault;
         }
         else if ((sgo = nsJSUtils::GetStaticScriptGlobal(target))) {
           // Icky, we have to fire an InternalScriptErrorEvent...
@@ -1239,16 +1236,14 @@ public:
           event.errorMsg = aMessage.get();
           event.fileName = aFilename.get();
 
-          nsEventStatus status = nsEventStatus_eIgnore;
           if (NS_FAILED(sgo->HandleScriptError(&event, &status))) {
             NS_WARNING("Failed to dispatch main thread error event!");
             status = nsEventStatus_eIgnore;
           }
-
-          preventDefaultCalled = status == nsEventStatus_eConsumeNoDefault;
         }
 
-        if (preventDefaultCalled) {
+        // Was preventDefault() called?
+        if (status == nsEventStatus_eConsumeNoDefault) {
           return true;
         }
       }

From 41c9799518e68da8fd4c7af63db8f4ca914ff59d Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 12:15:16 -0800
Subject: [PATCH 018/144] Bug 940765 - Root before preference checking, r=bz

---
 dom/base/Navigator.cpp | 12 ++++++++----
 dom/base/Navigator.h   |  4 ++--
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index 908f1f936649..443deca78c45 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -1703,14 +1703,16 @@ Navigator::HasMobileMessageSupport(JSContext* /* unused */, JSObject* aGlobal)
 
 /* static */
 bool
-Navigator::HasTelephonySupport(JSContext* /* unused */, JSObject* aGlobal)
+Navigator::HasTelephonySupport(JSContext* cx, JSObject* aGlobal)
 {
+  JS::Rooted<JSObject*> global(cx, aGlobal);
+
   // First of all, the general pref has to be turned on.
   bool enabled = false;
   Preferences::GetBool("dom.telephony.enabled", &enabled);
   NS_ENSURE_TRUE(enabled, false);
 
-  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(aGlobal);
+  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(global);
   return win && CheckPermission(win, "telephony");
 }
 
@@ -1854,8 +1856,10 @@ bool Navigator::HasInputMethodSupport(JSContext* /* unused */,
 
 /* static */
 bool
-Navigator::HasDataStoreSupport(JSContext* /* unused */, JSObject* aGlobal)
+Navigator::HasDataStoreSupport(JSContext* cx, JSObject* aGlobal)
 {
+  JS::Rooted<JSObject*> global(cx, aGlobal);
+
   // First of all, the general pref has to be turned on.
   bool enabled = false;
   Preferences::GetBool("dom.datastore.enabled", &enabled);
@@ -1866,7 +1870,7 @@ Navigator::HasDataStoreSupport(JSContext* /* unused */, JSObject* aGlobal)
     return true;
   }
 
-  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(aGlobal);
+  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(global);
   if (!win) {
     return false;
   }
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index 607b7086a960..282b3c51bd60 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -250,7 +250,7 @@ public:
   }
   static bool HasMobileMessageSupport(JSContext* /* unused */,
                                       JSObject* aGlobal);
-  static bool HasTelephonySupport(JSContext* /* unused */,
+  static bool HasTelephonySupport(JSContext* cx,
                                   JSObject* aGlobal);
   static bool HasCameraSupport(JSContext* /* unused */,
                                JSObject* aGlobal);
@@ -286,7 +286,7 @@ public:
 
   static bool HasInputMethodSupport(JSContext* /* unused */, JSObject* aGlobal);
 
-  static bool HasDataStoreSupport(JSContext* /* unused */, JSObject* aGlobal);
+  static bool HasDataStoreSupport(JSContext* cx, JSObject* aGlobal);
 
   nsPIDOMWindow* GetParentObject() const
   {

From 6f9caffe805cdf8a8b881e5bf7f221af679d26a4 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 15:12:29 +0900
Subject: [PATCH 019/144] Bug 949875 - Delay import some WebIDL modules;
 r=glandium

This prevents excessive dependencies on config.status. Those extra
dependencies make WebIDL developer workflow inefficient.

--HG--
extra : rebase_source : 37ba82773fe6d873e25fc8b61fef44ec9f191ebe
extra : amend_source : 3fa0796f096efdbe6a74138ea0258f68cbcf4071
---
 dom/bindings/mozwebidlcodegen/__init__.py | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index 5516dbb3a1a0..cbd6312b23d4 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -24,14 +24,8 @@ from mozbuild.util import FileAvoidWrite
 
 import mozpack.path as mozpath
 
-import WebIDL
-from Codegen import (
-    CGBindingRoot,
-    CGEventRoot,
-    CGExampleRoot,
-    GlobalGenRoots,
-)
-from Configuration import Configuration
+# There are various imports in this file in functions to avoid adding
+# dependencies to config.status. See bug 949875.
 
 
 class BuildResult(object):
@@ -305,11 +299,16 @@ class WebIDLCodegenManager(LoggingMixin):
 
     def generate_example_files(self, interface):
         """Generates example files for a given interface."""
+        from Codegen import CGExampleRoot
+
         root = CGExampleRoot(self.config, interface)
 
         return self._maybe_write_codegen(root, *self._example_paths(interface))
 
     def _parse_webidl(self):
+        import WebIDL
+        from Configuration import Configuration
+
         self.log(logging.INFO, 'webidl_parse',
             {'count': len(self._input_paths)},
             'Parsing {count} WebIDL files.')
@@ -328,6 +327,8 @@ class WebIDLCodegenManager(LoggingMixin):
         self._input_hashes = hashes
 
     def _write_global_derived(self):
+        from Codegen import GlobalGenRoots
+
         things = [('declare', f) for f in self.GLOBAL_DECLARE_FILES]
         things.extend(('define', f) for f in self.GLOBAL_DEFINE_FILES)
 
@@ -453,6 +454,11 @@ class WebIDLCodegenManager(LoggingMixin):
         return paths
 
     def _generate_build_files_for_webidl(self, filename):
+        from Codegen import (
+            CGBindingRoot,
+            CGEventRoot,
+        )
+
         self.log(logging.INFO, 'webidl_generate_build_for_input',
             {'filename': filename},
             'Generating WebIDL files derived from {filename}')

From 09c13814b1ee01c76e530aab1795c285281cdb74 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 00:03:55 +0900
Subject: [PATCH 020/144] Bug 949304 - Print Makefile counts during
 config.status; r=glandium

We now capture and print the number of Makefile.in and the number of
generated Makefile as part of config.status. This should give us a nice,
easy to extract metric going forward.

--HG--
extra : rebase_source : 48a3e9f66975505dec76746703875b2364dedc87
---
 .../mozbuild/backend/recursivemake.py         | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index c9a4000dd46a..a909efff8ee4 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -268,17 +268,25 @@ class RecursiveMakeBackend(CommonBackend):
         self._ipdl_sources = set()
 
         def detailed(summary):
-            s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
+            s = '{:d} total backend files; ' \
+                '{:d} created; {:d} updated; {:d} unchanged; ' \
+                '{:d} deleted; {:d} -> {:d} Makefile'.format(
                 summary.created_count + summary.updated_count +
-                summary.unchanged_count, summary.created_count,
-                summary.updated_count, summary.unchanged_count)
-            if summary.deleted_count:
-                s+= '; {:d} deleted'.format(summary.deleted_count)
+                summary.unchanged_count,
+                summary.created_count,
+                summary.updated_count,
+                summary.unchanged_count,
+                summary.deleted_count,
+                summary.makefile_in_count,
+                summary.makefile_out_count)
+
             return s
 
         # This is a little kludgy and could be improved with a better API.
         self.summary.backend_detailed_summary = types.MethodType(detailed,
             self.summary)
+        self.summary.makefile_in_count = 0
+        self.summary.makefile_out_count = 0
 
         self._test_manifests = {}
 
@@ -664,6 +672,7 @@ class RecursiveMakeBackend(CommonBackend):
                 if not stub:
                     self.log(logging.DEBUG, 'substitute_makefile',
                         {'path': makefile}, 'Substituting makefile: {path}')
+                    self.summary.makefile_in_count += 1
 
                     for tier, skiplist in self._may_skip.items():
                         if tier in ('compile', 'binaries'):
@@ -1104,6 +1113,8 @@ class RecursiveMakeBackend(CommonBackend):
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
 
+        self.summary.makefile_out_count += 1
+
     def _handle_webidl_collection(self, webidls):
         if not webidls.all_stems():
             return

From d917ee6f02beb60e1e5f0a6d55fc209325656710 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 12 Dec 2013 23:18:43 -0800
Subject: [PATCH 021/144] Bug 944074 - Remove the ParallelArray constructor.
 (r=nmatsakis)

---
 .../mochitest/general/test_interfaces.html    |    1 -
 js/src/Makefile.in                            |    1 -
 js/src/builtin/Array.js                       |    4 +-
 js/src/builtin/ParallelArray.cpp              |  247 ----
 js/src/builtin/ParallelArray.h                |   56 -
 js/src/builtin/ParallelArray.js               | 1253 -----------------
 js/src/builtin/Utilities.js                   |   30 +
 js/src/jit-test/lib/parallelarray-helpers.js  |   98 +-
 .../jit-test/tests/auto-regress/bug755564.js  |    9 -
 .../jit-test/tests/auto-regress/bug783923.js  |    6 -
 .../jit-test/tests/auto-regress/bug784011.js  |    8 -
 .../jit-test/tests/auto-regress/bug786106.js  |    8 -
 .../jit-test/tests/auto-regress/bug789107.js  |    7 -
 .../jit-test/tests/auto-regress/bug791445.js  |    7 -
 js/src/jit-test/tests/baseline/bug846072.js   |    7 -
 js/src/jit-test/tests/baseline/bug857579.js   |   22 -
 js/src/jit-test/tests/basic/bug815652.js      |   12 -
 .../tests/parallel/binary-arith-numbers.js    |    5 +-
 js/src/jit-test/tests/parallel/bug783924.js   |    7 -
 js/src/jit-test/tests/parallel/bug787282.js   |   16 -
 js/src/jit-test/tests/parallel/bug853555.js   |   12 -
 js/src/jit-test/tests/parallel/bug853573.js   |   17 -
 js/src/jit-test/tests/parallel/bug854021.js   |    3 -
 js/src/jit-test/tests/parallel/bug854050.js   |   10 -
 js/src/jit-test/tests/parallel/bug854381.js   |   20 -
 js/src/jit-test/tests/parallel/bug857846.js   |    9 -
 js/src/jit-test/tests/parallel/bug858077.js   |    5 -
 js/src/jit-test/tests/parallel/bug858582.js   |   68 -
 js/src/jit-test/tests/parallel/bug890465.js   |    6 -
 js/src/jit-test/tests/parallel/bug894782.js   |    6 -
 js/src/jit-test/tests/parallel/bug895782.js   |   12 -
 js/src/jit-test/tests/parallel/bug908939.js   |   13 -
 js/src/jit-test/tests/parallel/bug909599.js   |    6 -
 .../jit-test/tests/parallel/compare-values.js |   16 +-
 .../tests/parallel/comprehension-2.js         |   13 -
 .../tests/parallel/comprehension-fn-args.js   |   16 -
 .../tests/parallel/comprehension-scale.js     |   22 -
 .../jit-test/tests/parallel/constructor-1.js  |   15 -
 .../jit-test/tests/parallel/constructor-2.js  |   15 -
 .../jit-test/tests/parallel/constructor-3.js  |   14 -
 .../jit-test/tests/parallel/constructor-4.js  |   16 -
 .../jit-test/tests/parallel/constructor-5.js  |   18 -
 .../tests/parallel/constructor-throws.js      |   10 -
 js/src/jit-test/tests/parallel/element-1.js   |   14 -
 js/src/jit-test/tests/parallel/element-2.js   |   26 -
 js/src/jit-test/tests/parallel/element-3.js   |   12 -
 js/src/jit-test/tests/parallel/flatten-1.js   |   14 -
 js/src/jit-test/tests/parallel/flatten-2.js   |   10 -
 js/src/jit-test/tests/parallel/flatten-3.js   |   25 -
 .../jit-test/tests/parallel/flatten-throws.js |   12 -
 js/src/jit-test/tests/parallel/get-1.js       |    9 -
 js/src/jit-test/tests/parallel/get-2.js       |   14 -
 js/src/jit-test/tests/parallel/get-3.js       |    9 -
 js/src/jit-test/tests/parallel/get-4.js       |    7 -
 js/src/jit-test/tests/parallel/get-6.js       |   14 -
 js/src/jit-test/tests/parallel/holes-1.js     |   31 -
 js/src/jit-test/tests/parallel/holes-2.js     |   25 -
 js/src/jit-test/tests/parallel/index-1.js     |    9 -
 js/src/jit-test/tests/parallel/index-2.js     |   18 -
 js/src/jit-test/tests/parallel/index-3.js     |   25 -
 js/src/jit-test/tests/parallel/index-4.js     |   27 -
 .../tests/parallel/inline-new-bad-type.js     |   18 -
 js/src/jit-test/tests/parallel/length-1.js    |   12 -
 js/src/jit-test/tests/parallel/length-2.js    |   13 -
 js/src/jit-test/tests/parallel/length-3.js    |   11 -
 js/src/jit-test/tests/parallel/mandelbrot.js  |    4 +-
 js/src/jit-test/tests/parallel/map-3.js       |   12 -
 .../tests/parallel/overflow-throws.js         |   12 -
 js/src/jit-test/tests/parallel/partition-1.js |   15 -
 .../tests/parallel/partition-throws.js        |   10 -
 .../tests/parallel/reduce-higher-dim.js       |   14 -
 .../jit-test/tests/parallel/reduce-throws.js  |   17 -
 js/src/jit-test/tests/parallel/scan-3.js      |   17 -
 js/src/jit-test/tests/parallel/scan-throws.js |   18 -
 js/src/jit-test/tests/parallel/scatter-1.js   |    8 -
 js/src/jit-test/tests/parallel/scatter-10.js  |   21 -
 js/src/jit-test/tests/parallel/scatter-11.js  |   21 -
 js/src/jit-test/tests/parallel/scatter-12.js  |   22 -
 js/src/jit-test/tests/parallel/scatter-13.js  |   24 -
 js/src/jit-test/tests/parallel/scatter-2.js   |   10 -
 js/src/jit-test/tests/parallel/scatter-3.js   |   12 -
 js/src/jit-test/tests/parallel/scatter-4.js   |   10 -
 js/src/jit-test/tests/parallel/scatter-5.js   |    9 -
 js/src/jit-test/tests/parallel/scatter-6.js   |   13 -
 js/src/jit-test/tests/parallel/scatter-7.js   |   15 -
 js/src/jit-test/tests/parallel/scatter-8.js   |   16 -
 js/src/jit-test/tests/parallel/scatter-9.js   |   12 -
 .../tests/parallel/scatter-regression-1.js    |   18 -
 .../jit-test/tests/parallel/scatter-throws.js |   31 -
 js/src/jit-test/tests/parallel/shape-1.js     |    8 -
 js/src/jit-test/tests/parallel/shape-2.js     |   15 -
 js/src/jit-test/tests/parallel/shape-3.js     |   16 -
 js/src/jit-test/tests/parallel/shape-4.js     |   13 -
 js/src/jit-test/tests/parallel/shape-5.js     |   13 -
 .../jit-test/tests/parallel/stack-overflow.js |    4 +-
 js/src/jit-test/tests/parallel/toString-1.js  |    6 -
 js/src/jit/BaselineIC.cpp                     |   13 -
 js/src/jit/CodeGenerator.cpp                  |   70 -
 js/src/jit/CodeGenerator.h                    |    4 -
 js/src/jit/IonBuilder.h                       |   10 -
 js/src/jit/LIR-Common.h                       |   10 -
 js/src/jit/LOpcodes.h                         |    1 -
 js/src/jit/Lowering.cpp                       |    7 -
 js/src/jit/Lowering.h                         |    1 -
 js/src/jit/MCallOptimize.cpp                  |  152 --
 js/src/jit/MIR.h                              |   26 -
 js/src/jit/MOpcodes.h                         |    1 -
 js/src/jit/ParallelSafetyAnalysis.cpp         |    7 -
 js/src/jit/VMFunctions.cpp                    |   16 -
 js/src/js.msg                                 |    8 +-
 js/src/jsapi.cpp                              |    1 -
 js/src/jsinferinlines.h                       |    4 -
 js/src/jsprototypes.h                         |    7 +-
 js/src/moz.build                              |    1 -
 js/src/vm/ForkJoin.cpp                        |    2 +-
 js/src/vm/GlobalObject.cpp                    |    3 -
 js/src/vm/SelfHosting.cpp                     |   23 -
 117 files changed, 58 insertions(+), 3246 deletions(-)
 delete mode 100644 js/src/builtin/ParallelArray.cpp
 delete mode 100644 js/src/builtin/ParallelArray.h
 delete mode 100644 js/src/builtin/ParallelArray.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug755564.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug783923.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug784011.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug786106.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug789107.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug791445.js
 delete mode 100644 js/src/jit-test/tests/baseline/bug846072.js
 delete mode 100644 js/src/jit-test/tests/baseline/bug857579.js
 delete mode 100644 js/src/jit-test/tests/basic/bug815652.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug783924.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug787282.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug853555.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug853573.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug854021.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug854050.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug854381.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug857846.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug858077.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug858582.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug890465.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug894782.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug895782.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug908939.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug909599.js
 delete mode 100644 js/src/jit-test/tests/parallel/comprehension-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/comprehension-fn-args.js
 delete mode 100644 js/src/jit-test/tests/parallel/comprehension-scale.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-5.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/element-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/element-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/element-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-6.js
 delete mode 100644 js/src/jit-test/tests/parallel/holes-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/holes-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/inline-new-bad-type.js
 delete mode 100644 js/src/jit-test/tests/parallel/length-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/length-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/length-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/map-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/overflow-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/partition-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/partition-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/reduce-higher-dim.js
 delete mode 100644 js/src/jit-test/tests/parallel/reduce-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/scan-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/scan-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-10.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-11.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-12.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-13.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-5.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-6.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-7.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-8.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-9.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-regression-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-5.js
 delete mode 100644 js/src/jit-test/tests/parallel/toString-1.js

diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 3b2363f47d9f..0ec83523aa00 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -69,7 +69,6 @@ var ecmaGlobals =
     {name: "NaN", xbl: false},
     "Number",
     "Object",
-    {name: "ParallelArray", nightly: true},
     "Proxy",
     "RangeError",
     "ReferenceError",
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 1a7008f5c4c6..6999747d6d3d 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -579,7 +579,6 @@ selfhosting_srcs := \
   $(srcdir)/builtin/Iterator.js \
   $(srcdir)/builtin/Map.js \
   $(srcdir)/builtin/Number.js \
-  $(srcdir)/builtin/ParallelArray.js \
   $(srcdir)/builtin/String.js \
   $(srcdir)/builtin/Set.js \
   $(srcdir)/builtin/TypedObject.js \
diff --git a/js/src/builtin/Array.js b/js/src/builtin/Array.js
index b61c6c6a3192..d27f159ac295 100644
--- a/js/src/builtin/Array.js
+++ b/js/src/builtin/Array.js
@@ -556,6 +556,8 @@ function ArrayKeys() {
     return CreateArrayIterator(this, ITEM_KIND_KEY);
 }
 
+#ifdef ENABLE_PARALLEL_JS
+
 /*
  * Strawman spec:
  *   http://wiki.ecmascript.org/doku.php?id=strawman:data_parallelism
@@ -649,8 +651,6 @@ function ComputeAllSliceBounds(numItems, numSlices) {
   return info;
 }
 
-#ifdef ENABLE_PARALLEL_JS
-
 /**
  * Creates a new array by applying |func(e, i, self)| for each element |e|
  * with index |i|.
diff --git a/js/src/builtin/ParallelArray.cpp b/js/src/builtin/ParallelArray.cpp
deleted file mode 100644
index a046819a9a2e..000000000000
--- a/js/src/builtin/ParallelArray.cpp
+++ /dev/null
@@ -1,247 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "builtin/ParallelArray.h"
-
-#include "jsobj.h"
-
-#include "vm/GlobalObject.h"
-#include "vm/String.h"
-
-#include "jsobjinlines.h"
-
-using namespace js;
-
-//
-// ParallelArrayObject
-//
-
-FixedHeapPtr<PropertyName> ParallelArrayObject::ctorNames[NumCtors];
-
-const JSFunctionSpec ParallelArrayObject::methods[] = {
-    JS_SELF_HOSTED_FN("map",       "ParallelArrayMap",       2, 0),
-    JS_SELF_HOSTED_FN("reduce",    "ParallelArrayReduce",    2, 0),
-    JS_SELF_HOSTED_FN("scan",      "ParallelArrayScan",      2, 0),
-    JS_SELF_HOSTED_FN("scatter",   "ParallelArrayScatter",   5, 0),
-    JS_SELF_HOSTED_FN("filter",    "ParallelArrayFilter",    2, 0),
-    JS_SELF_HOSTED_FN("partition", "ParallelArrayPartition", 1, 0),
-    JS_SELF_HOSTED_FN("flatten",   "ParallelArrayFlatten",   0, 0),
-
-    // FIXME #838906. Note that `get()` is not currently defined on this table but
-    // rather is assigned to each instance of ParallelArray as an own
-    // property.  This is a bit of a hack designed to supply a
-    // specialized version of get() based on the dimensionality of the
-    // receiver.  In the future we can improve this by (1) extending
-    // TI to track the dimensionality of the receiver and (2) using a
-    // hint to aggressively inline calls to get().
-    // JS_SELF_HOSTED_FN("get", "ParallelArrayGet", 1, 0),
-
-    JS_SELF_HOSTED_FN("toString",  "ParallelArrayToString",  0, 0),
-    JS_FS_END
-};
-
-const JSPropertySpec ParallelArrayObject::properties[] = {
-    JS_SELF_HOSTED_GET("length", "ParallelArrayLength", JSPROP_PERMANENT),
-    JS_PS_END
-};
-
-const Class ParallelArrayObject::protoClass = {
-    "ParallelArray",
-    JSCLASS_HAS_CACHED_PROTO(JSProto_ParallelArray),
-    JS_PropertyStub,         // addProperty
-    JS_DeletePropertyStub,   // delProperty
-    JS_PropertyStub,         // getProperty
-    JS_StrictPropertyStub,   // setProperty
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub
-};
-
-const Class ParallelArrayObject::class_ = {
-    "ParallelArray",
-    JSCLASS_HAS_CACHED_PROTO(JSProto_ParallelArray),
-    JS_PropertyStub,         // addProperty
-    JS_DeletePropertyStub,   // delProperty
-    JS_PropertyStub,         // getProperty
-    JS_StrictPropertyStub,   // setProperty
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub
-};
-
-/*static*/ bool
-ParallelArrayObject::initProps(JSContext *cx, HandleObject obj)
-{
-    RootedValue undef(cx, UndefinedValue());
-    RootedValue zero(cx, Int32Value(0));
-
-    if (!JSObject::defineProperty(cx, obj, cx->names().buffer, undef))
-        return false;
-    if (!JSObject::defineProperty(cx, obj, cx->names().offset, zero))
-        return false;
-    if (!JSObject::defineProperty(cx, obj, cx->names().shape, undef))
-        return false;
-    if (!JSObject::defineProperty(cx, obj, cx->names().get, undef))
-        return false;
-
-    return true;
-}
-
-/*static*/ bool
-ParallelArrayObject::construct(JSContext *cx, unsigned argc, Value *vp)
-{
-    RootedFunction ctor(cx, getConstructor(cx, argc));
-    if (!ctor)
-        return false;
-    CallArgs args = CallArgsFromVp(argc, vp);
-    return constructHelper(cx, &ctor, args);
-}
-
-/* static */ JSFunction *
-ParallelArrayObject::maybeGetConstructor(GlobalObject *global, unsigned argc)
-{
-    PropertyName *ctorName = ctorNames[js::Min(argc, NumCtors - 1)];
-    Value ctorValue;
-    if (!global->maybeGetIntrinsicValue(ctorName, &ctorValue))
-        return nullptr;
-    JS_ASSERT(ctorValue.isObject() && ctorValue.toObject().is<JSFunction>());
-    return &ctorValue.toObject().as<JSFunction>();
-}
-
-/* static */ JSFunction *
-ParallelArrayObject::getConstructor(JSContext *cx, unsigned argc)
-{
-    RootedPropertyName ctorName(cx, ctorNames[js::Min(argc, NumCtors - 1)]);
-    RootedValue ctorValue(cx);
-    if (!cx->global()->getIntrinsicValue(cx, ctorName, &ctorValue))
-        return nullptr;
-    JS_ASSERT(ctorValue.isObject() && ctorValue.toObject().is<JSFunction>());
-    return &ctorValue.toObject().as<JSFunction>();
-}
-
-/*static*/ JSObject *
-ParallelArrayObject::newInstance(JSContext *cx, NewObjectKind newKind /* = GenericObject */)
-{
-    gc::AllocKind kind = gc::GetGCObjectKind(NumFixedSlots);
-    RootedObject result(cx, NewBuiltinClassInstance(cx, &class_, kind, newKind));
-    if (!result)
-        return nullptr;
-
-    // Add in the basic PA properties now with default values:
-    if (!initProps(cx, result))
-        return nullptr;
-
-    return result;
-}
-
-/*static*/ bool
-ParallelArrayObject::constructHelper(JSContext *cx, MutableHandleFunction ctor, CallArgs &args0)
-{
-    RootedObject result(cx, newInstance(cx, TenuredObject));
-    if (!result)
-        return false;
-
-    if (cx->typeInferenceEnabled()) {
-        jsbytecode *pc;
-        RootedScript script(cx, cx->currentScript(&pc));
-        if (script) {
-            if (ctor->nonLazyScript()->shouldCloneAtCallsite()) {
-                ctor.set(CloneFunctionAtCallsite(cx, ctor, script, pc));
-                if (!ctor)
-                    return false;
-            }
-
-            // Create the type object for the PA.  Add in the current
-            // properties as definite properties if this type object is newly
-            // created.  To tell if it is newly created, we check whether it
-            // has any properties yet or not, since any returned type object
-            // must have been created by this same C++ code and hence would
-            // already have properties if it had been returned before.
-            types::TypeObject *paTypeObject =
-                types::TypeScript::InitObject(cx, script, pc, JSProto_ParallelArray);
-            if (!paTypeObject)
-                return false;
-            if (paTypeObject->getPropertyCount() == 0 && !paTypeObject->unknownProperties()) {
-                if (!paTypeObject->addDefiniteProperties(cx, result))
-                    return false;
-
-                // addDefiniteProperties() above should have added one
-                // property for each of the fixed slots:
-                JS_ASSERT(paTypeObject->getPropertyCount() == NumFixedSlots);
-            }
-            result->setType(paTypeObject);
-        }
-    }
-
-    InvokeArgs args(cx);
-    if (!args.init(args0.length()))
-        return false;
-
-    args.setCallee(ObjectValue(*ctor));
-    args.setThis(ObjectValue(*result));
-
-    for (uint32_t i = 0; i < args0.length(); i++)
-        args[i].set(args0[i]);
-
-    if (!Invoke(cx, args))
-        return false;
-
-    args0.rval().setObject(*result);
-    return true;
-}
-
-JSObject *
-ParallelArrayObject::initClass(JSContext *cx, HandleObject obj)
-{
-    JS_ASSERT(obj->isNative());
-
-    // Cache constructor names.
-    {
-        static const char *const ctorStrs[NumCtors] = {
-            "ParallelArrayConstructEmpty",
-            "ParallelArrayConstructFromArray",
-            "ParallelArrayConstructFromFunction",
-            "ParallelArrayConstructFromFunctionMode"
-        };
-        for (uint32_t i = 0; i < NumCtors; i++) {
-            JSAtom *atom = Atomize(cx, ctorStrs[i], strlen(ctorStrs[i]), InternAtom);
-            if (!atom)
-                return nullptr;
-            ctorNames[i].init(atom->asPropertyName());
-        }
-    }
-
-    Rooted<GlobalObject *> global(cx, &obj->as<GlobalObject>());
-
-    RootedObject proto(cx, global->createBlankPrototype(cx, &protoClass));
-    if (!proto)
-        return nullptr;
-
-    JSProtoKey key = JSProto_ParallelArray;
-    RootedFunction ctor(cx, global->createConstructor(cx, construct,
-                                                      cx->names().ParallelArray, 0));
-    if (!ctor ||
-        !LinkConstructorAndPrototype(cx, ctor, proto) ||
-        !DefinePropertiesAndBrand(cx, proto, properties, methods) ||
-        !DefineConstructorAndPrototype(cx, global, key, ctor, proto))
-    {
-        return nullptr;
-    }
-
-    return proto;
-}
-
-bool
-ParallelArrayObject::is(const Value &v)
-{
-    return v.isObject() && v.toObject().hasClass(&class_);
-}
-
-JSObject *
-js_InitParallelArrayClass(JSContext *cx, js::HandleObject obj)
-{
-    return ParallelArrayObject::initClass(cx, obj);
-}
diff --git a/js/src/builtin/ParallelArray.h b/js/src/builtin/ParallelArray.h
deleted file mode 100644
index 3232ae70b2d0..000000000000
--- a/js/src/builtin/ParallelArray.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef builtin_ParallelArray_h
-#define builtin_ParallelArray_h
-
-#include "jsobj.h"
-
-namespace js {
-
-class ParallelArrayObject : public JSObject
-{
-    static const Class protoClass;
-    static const JSFunctionSpec methods[];
-    static const JSPropertySpec properties[];
-    static const uint32_t NumFixedSlots = 4;
-    static const uint32_t NumCtors = 4;
-    static FixedHeapPtr<PropertyName> ctorNames[NumCtors];
-
-    static bool initProps(JSContext *cx, HandleObject obj);
-
-  public:
-    static const Class class_;
-
-    static bool construct(JSContext *cx, unsigned argc, Value *vp);
-    static bool constructHelper(JSContext *cx, MutableHandleFunction ctor, CallArgs &args);
-
-    // Creates a new ParallelArray instance with the correct number of slots
-    // and so forth.
-    //
-    // NOTE: This object will NOT have the correct type object! It is
-    // up to the caller to adjust the type object appropriately
-    // before releasing the object into the wild.  You probably want
-    // to be calling construct() above, which will adjust the type
-    // object for you, since ParallelArray type objects must be setup
-    // in a rather particular way to interact well with the
-    // self-hosted code.  See constructHelper() for details.
-    static JSObject *newInstance(JSContext *cx, NewObjectKind newKind = GenericObject);
-
-    // Get the constructor function for argc number of arguments.
-    static JSFunction *maybeGetConstructor(GlobalObject *global, unsigned argc);
-    static JSFunction *getConstructor(JSContext *cx, unsigned argc);
-
-    static JSObject *initClass(JSContext *cx, HandleObject obj);
-    static bool is(const Value &v);
-};
-
-} // namespace js
-
-extern JSObject *
-js_InitParallelArrayClass(JSContext *cx, js::HandleObject obj);
-
-#endif /* builtin_ParallelArray_h */
diff --git a/js/src/builtin/ParallelArray.js b/js/src/builtin/ParallelArray.js
deleted file mode 100644
index 4ae4c09c1850..000000000000
--- a/js/src/builtin/ParallelArray.js
+++ /dev/null
@@ -1,1253 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// FIXME(bug 844882): Parallel array properties should not be exposed.
-
-/**
- * Compute the partial products in reverse order.
- * e.g., if the shape is [A,B,C,D], then the
- * array |products| will be [1,D,CD,BCD].
- */
-function ComputeProducts(shape) {
-  var product = 1;
-  var products = [1];
-  var sdimensionality = shape.length;
-  for (var i = sdimensionality - 1; i > 0; i--) {
-    product *= shape[i];
-    ARRAY_PUSH(products, product);
-  }
-  return products;
-}
-
-/**
- * Given a shape and some index |index1d|, computes and returns an
- * array containing the N-dimensional index that maps to |index1d|.
- */
-function ComputeIndices(shape, index1d) {
-
-  var products = ComputeProducts(shape);
-  var l = shape.length;
-
-  var result = [];
-  for (var i = 0; i < l; i++) {
-    // Obtain product of all higher dimensions.
-    // So if i == 0 and shape is [A,B,C,D], yields BCD.
-    var stride = products[l - i - 1];
-
-    // Compute how many steps of width stride we could take.
-    var index = (index1d / stride) | 0;
-    ARRAY_PUSH(result, index);
-
-    // Adjust remaining indices for smaller dimensions.
-    index1d -= (index * stride);
-  }
-
-  return result;
-}
-
-function StepIndices(shape, indices) {
-  for (var i = shape.length - 1; i >= 0; i--) {
-    var indexi = indices[i] + 1;
-    if (indexi < shape[i]) {
-      indices[i] = indexi;
-      return;
-    }
-    indices[i] = 0;
-  }
-}
-
-// Constructor
-//
-// We split the 3 construction cases so that we don't case on arguments.
-
-/**
- * This is the function invoked for |new ParallelArray()|
- */
-function ParallelArrayConstructEmpty() {
-  this.buffer = [];
-  this.offset = 0;
-  this.shape = [0];
-  this.get = ParallelArrayGet1;
-}
-
-/**
- * This is the function invoked for |new ParallelArray(array)|.
- * It copies the data from its array-like argument |array|.
- */
-function ParallelArrayConstructFromArray(array) {
-  var buffer = ToObject(array);
-  var length = buffer.length >>> 0;
-  if (length !== buffer.length)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-
-  var buffer1 = [];
-  for (var i = 0; i < length; i++)
-    ARRAY_PUSH(buffer1, buffer[i]);
-
-  this.buffer = buffer1;
-  this.offset = 0;
-  this.shape = [length];
-  this.get = ParallelArrayGet1;
-}
-
-/**
- * Wrapper around |ParallelArrayConstructFromComprehension()| for the
- * case where 2 arguments are supplied. This is typically what users will
- * invoke. We provide an explicit two-argument version rather than
- * relying on JS's semantics for absent arguments because it simplifies
- * the ion code that does inlining of PA constructors.
- */
-function ParallelArrayConstructFromFunction(shape, func) {
-  return ParallelArrayConstructFromComprehension(this, shape, func, undefined);
-}
-
-/**
- * Wrapper around |ParallelArrayConstructFromComprehension()| for the
- * case where 3 arguments are supplied.
- */
-function ParallelArrayConstructFromFunctionMode(shape, func, mode) {
-  return ParallelArrayConstructFromComprehension(this, shape, func, mode);
-}
-
-/**
- * "Comprehension form": This is the function invoked for |new
- * ParallelArray(dim, fn)|. If |dim| is a number, then it creates a
- * new 1-dimensional parallel array with shape |[dim]| where index |i|
- * is equal to |fn(i)|. If |dim| is a vector, then it creates a new
- * N-dimensional parallel array where index |a, b, ... z| is equal to
- * |fn(a, b, ...z)|.
- *
- * The final |mode| argument is an internal argument used only
- * during our unit-testing.
- */
-function ParallelArrayConstructFromComprehension(self, shape, func, mode) {
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  if (typeof shape === "number") {
-    var length = shape >>> 0;
-    if (length !== shape)
-      ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-    ParallelArrayBuild(self, [length], func, mode);
-  } else if (!shape || typeof shape.length !== "number") {
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-  } else {
-    var shape1 = [];
-    for (var i = 0, l = shape.length; i < l; i++) {
-      var s0 = shape[i];
-      var s1 = s0 >>> 0;
-      if (s1 !== s0)
-        ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-      ARRAY_PUSH(shape1, s1);
-    }
-    ParallelArrayBuild(self, shape1, func, mode);
-  }
-}
-
-/**
- * Internal function used when constructing new parallel arrays. The
- * NewParallelArray() intrinsic takes a ctor function which it invokes
- * with the given shape, buffer, offset. The |this| parameter will be
- * the newly constructed parallel array.
- */
-function ParallelArrayView(shape, buffer, offset) {
-  this.shape = shape;
-  this.buffer = buffer;
-  this.offset = offset;
-
-  switch (shape.length) {
-    case 1: this.get = ParallelArrayGet1; break;
-    case 2: this.get = ParallelArrayGet2; break;
-    case 3: this.get = ParallelArrayGet3; break;
-    default: this.get = ParallelArrayGetN; break;
-  }
-
-  // Due to inlining of NewParallelArray, the return type of this function
-  // gets recorded as the return type of NewParallelArray at inlined sites, so
-  // we must take care to return the same thing.
-  return this;
-}
-
-/**
- * Helper for the comprehension form. Constructs an N-dimensional
- * array where |N == shape.length|. |shape| must be an array of
- * integers. The data for any given index vector |i| is determined by
- * |func(...i)|.
- */
-function ParallelArrayBuild(self, shape, func, mode) {
-  self.offset = 0;
-  self.shape = shape;
-
-  var length;
-  var xDimension, yDimension, zDimension;
-  var computefunc;
-
-  switch (shape.length) {
-  case 1:
-    length = shape[0];
-    self.get = ParallelArrayGet1;
-    computefunc = fill1;
-    break;
-  case 2:
-    xDimension = shape[0];
-    yDimension = shape[1];
-    length = xDimension * yDimension;
-    self.get = ParallelArrayGet2;
-    computefunc = fill2;
-    break;
-  case 3:
-    xDimension = shape[0];
-    yDimension = shape[1];
-    zDimension = shape[2];
-    length = xDimension * yDimension * zDimension;
-    self.get = ParallelArrayGet3;
-    computefunc = fill3;
-    break;
-  default:
-    length = 1;
-    for (var i = 0; i < shape.length; i++)
-      length *= shape[i];
-    self.get = ParallelArrayGetN;
-    computefunc = fillN;
-    break;
-  }
-
-  var buffer = self.buffer = NewDenseArray(length);
-
-  parallel: for (;;) {
-    // Avoid parallel compilation if we are already nested in another
-    // parallel section or the user told us not to parallelize. The
-    // use of a for (;;) loop is working around some ion limitations:
-    //
-    // - Breaking out of named blocks does not currently work (bug 684384);
-    // - Unreachable Code Elim. can't properly handle if (a && b) (bug 669796)
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-    if (computefunc === fillN)
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-    ForkJoin(constructSlice, ForkJoinMode(mode));
-    return;
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  computefunc(0, length);
-  return;
-
-  function constructSlice(sliceId, numSlices, warmup) {
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos)
-      chunkEnd = chunkPos + 1;
-
-    while (chunkPos < chunkEnd) {
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      computefunc(indexStart, indexEnd);
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  function fill1(indexStart, indexEnd) {
-    for (var i = indexStart; i < indexEnd; i++)
-      UnsafePutElements(buffer, i, func(i));
-  }
-
-  function fill2(indexStart, indexEnd) {
-    var x = (indexStart / yDimension) | 0;
-    var y = indexStart - x * yDimension;
-    for (var i = indexStart; i < indexEnd; i++) {
-      UnsafePutElements(buffer, i, func(x, y));
-      if (++y == yDimension) {
-        y = 0;
-        ++x;
-      }
-    }
-  }
-
-  function fill3(indexStart, indexEnd) {
-    var x = (indexStart / (yDimension * zDimension)) | 0;
-    var r = indexStart - x * yDimension * zDimension;
-    var y = (r / zDimension) | 0;
-    var z = r - y * zDimension;
-    for (var i = indexStart; i < indexEnd; i++) {
-      UnsafePutElements(buffer, i, func(x, y, z));
-      if (++z == zDimension) {
-        z = 0;
-        if (++y == yDimension) {
-          y = 0;
-          ++x;
-        }
-      }
-    }
-  }
-
-  function fillN(indexStart, indexEnd) {
-    var indices = ComputeIndices(shape, indexStart);
-    for (var i = indexStart; i < indexEnd; i++) {
-      var result = callFunction(std_Function_apply, func, null, indices);
-      UnsafePutElements(buffer, i, result);
-      StepIndices(shape, indices);
-    }
-  }
-}
-
-/**
- * Creates a new parallel array by applying |func(e, i, self)| for each
- * element |e| with index |i|. Note that
- * this always operates on the outermost dimension only.
- */
-function ParallelArrayMap(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-  var buffer = NewDenseArray(length);
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-    ForkJoin(mapSlice, ForkJoinMode(mode));
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  for (var i = 0; i < length; i++) {
-    // Note: Unlike JS arrays, parallel arrays cannot have holes.
-    var v = func(self.get(i), i, self);
-    UnsafePutElements(buffer, i, v);
-  }
-  return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-
-  function mapSlice(sliceId, numSlices, warmup) {
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos + 1)
-      chunkEnd = chunkPos + 1;
-
-    while (chunkPos < chunkEnd) {
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-
-      for (var i = indexStart; i < indexEnd; i++)
-        UnsafePutElements(buffer, i, func(self.get(i), i, self));
-
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  return undefined;
-}
-
-/**
- * Reduces the elements in a parallel array's outermost dimension
- * using the given reduction function.
- */
-function ParallelArrayReduce(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-
-  if (length === 0)
-    ThrowError(JSMSG_PAR_ARRAY_REDUCE_EMPTY);
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    if (chunks < numSlices)
-      break parallel;
-
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-    var subreductions = NewDenseArray(numSlices);
-    ForkJoin(reduceSlice, ForkJoinMode(mode));
-    var accumulator = subreductions[0];
-    for (var i = 1; i < numSlices; i++)
-      accumulator = func(accumulator, subreductions[i]);
-    return accumulator;
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  var accumulator = self.get(0);
-  for (var i = 1; i < length; i++)
-    accumulator = func(accumulator, self.get(i));
-  return accumulator;
-
-  function reduceSlice(sliceId, numSlices, warmup) {
-    var chunkStart = info[SLICE_START(sliceId)];
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    // (*) This function is carefully designed so that the warmup
-    // (which executes with chunkStart === chunkPos) will execute all
-    // potential loads and stores. In particular, the warmup run
-    // processes two chunks rather than one. Moreover, it stores
-    // accumulator into subreductions and then loads it again to
-    // ensure that the load is executed during the warmup, as it will
-    // certainly be executed during subsequent runs.
-
-    if (warmup && chunkEnd > chunkPos + 2)
-      chunkEnd = chunkPos + 2;
-
-    if (chunkStart === chunkPos) {
-      var indexPos = chunkStart << CHUNK_SHIFT;
-      var accumulator = reduceChunk(self.get(indexPos), indexPos + 1, indexPos + CHUNK_SIZE);
-
-      UnsafePutElements(subreductions, sliceId, accumulator, // see (*) above
-                        info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    var accumulator = subreductions[sliceId]; // see (*) above
-
-    while (chunkPos < chunkEnd) {
-      var indexPos = chunkPos << CHUNK_SHIFT;
-      accumulator = reduceChunk(accumulator, indexPos, indexPos + CHUNK_SIZE);
-      UnsafePutElements(subreductions, sliceId, accumulator, info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  function reduceChunk(accumulator, from, to) {
-    to = std_Math_min(to, length);
-    for (var i = from; i < to; i++)
-      accumulator = func(accumulator, self.get(i));
-    return accumulator;
-  }
-
-  return undefined;
-}
-
-/**
- * |scan()| returns an array [s_0, ..., s_N] where
- * |s_i| is equal to the reduction (as per |reduce()|)
- * of elements |0..i|. This is the generalization
- * of partial sum.
- */
-function ParallelArrayScan(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-
-  if (length === 0)
-    ThrowError(JSMSG_PAR_ARRAY_REDUCE_EMPTY);
-
-  var buffer = NewDenseArray(length);
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    if (chunks < numSlices)
-      break parallel;
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-
-    // Scan slices individually (see comment on phase1()).
-    ForkJoin(phase1, ForkJoinMode(mode));
-
-    // Compute intermediates array (see comment on phase2()).
-    var intermediates = [];
-    var accumulator = buffer[finalElement(0)];
-    ARRAY_PUSH(intermediates, accumulator);
-    for (var i = 1; i < numSlices - 1; i++) {
-      accumulator = func(accumulator, buffer[finalElement(i)]);
-      ARRAY_PUSH(intermediates, accumulator);
-    }
-
-    // Reset the current position information for each slice, but
-    // convert from chunks to indices (see comment on phase2()).
-    for (var i = 0; i < numSlices; i++) {
-      info[SLICE_POS(i)] = info[SLICE_START(i)] << CHUNK_SHIFT;
-      info[SLICE_END(i)] = info[SLICE_END(i)] << CHUNK_SHIFT;
-    }
-    info[SLICE_END(numSlices - 1)] = std_Math_min(info[SLICE_END(numSlices - 1)], length);
-
-    // Complete each slice using intermediates array (see comment on phase2()).
-    ForkJoin(phase2, ForkJoinMode(mode));
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  scan(self.get(0), 0, length);
-  return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-
-  function scan(accumulator, start, end) {
-    UnsafePutElements(buffer, start, accumulator);
-    for (var i = start + 1; i < end; i++) {
-      accumulator = func(accumulator, self.get(i));
-      UnsafePutElements(buffer, i, accumulator);
-    }
-    return accumulator;
-  }
-
-  /**
-   * In phase 1, we divide the source array into |numSlices| slices and
-   * compute scan on each slice sequentially as if it were the entire
-   * array. This function is responsible for computing one of those
-   * slices.
-   *
-   * So, if we have an array [A,B,C,D,E,F,G,H,I], |numSlices == 3|,
-   * and our function |func| is sum, then we would wind up computing a
-   * result array like:
-   *
-   *     [A, A+B, A+B+C, D, D+E, D+E+F, G, G+H, G+H+I]
-   *      ^~~~~~~~~~~~^  ^~~~~~~~~~~~^  ^~~~~~~~~~~~~^
-   *      Slice 0        Slice 1        Slice 2
-   *
-   * Read on in phase2 to see what we do next!
-   */
-  function phase1(sliceId, numSlices, warmup) {
-    var chunkStart = info[SLICE_START(sliceId)];
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos + 2)
-      chunkEnd = chunkPos + 2;
-
-    if (chunkPos == chunkStart) {
-      // For the first chunk, the accumulator begins as the value in
-      // the input at the start of the chunk.
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      scan(self.get(indexStart), indexStart, indexEnd);
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    while (chunkPos < chunkEnd) {
-      // For each subsequent chunk, the accumulator begins as the
-      // combination of the final value of prev chunk and the value in
-      // the input at the start of this chunk. Note that this loop is
-      // written as simple as possible, at the cost of an extra read
-      // from the buffer per iteration.
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      var accumulator = func(buffer[indexStart - 1], self.get(indexStart));
-      scan(accumulator, indexStart, indexEnd);
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  /**
-   * Computes the index of the final element computed by the slice |sliceId|.
-   */
-  function finalElement(sliceId) {
-    var chunkEnd = info[SLICE_END(sliceId)]; // last chunk written by |sliceId| is endChunk - 1
-    var indexStart = std_Math_min(chunkEnd << CHUNK_SHIFT, length);
-    return indexStart - 1;
-  }
-
-  /**
-   * After computing the phase1 results, we compute an
-   * |intermediates| array. |intermediates[i]| contains the result
-   * of reducing the final value from each preceding slice j<i with
-   * the final value of slice i. So, to continue our previous
-   * example, the intermediates array would contain:
-   *
-   *   [A+B+C, (A+B+C)+(D+E+F), ((A+B+C)+(D+E+F))+(G+H+I)]
-   *
-   * Here I have used parenthesization to make clear the order of
-   * evaluation in each case.
-   *
-   *   An aside: currently the intermediates array is computed
-   *   sequentially. In principle, we could compute it in parallel,
-   *   at the cost of doing duplicate work. This did not seem
-   *   particularly advantageous to me, particularly as the number
-   *   of slices is typically quite small (one per core), so I opted
-   *   to just compute it sequentially.
-   *
-   * Phase 2 combines the results of phase1 with the intermediates
-   * array to produce the final scan results. The idea is to
-   * reiterate over each element S[i] in the slice |sliceId|, which
-   * currently contains the result of reducing with S[0]...S[i]
-   * (where S0 is the first thing in the slice), and combine that
-   * with |intermediate[sliceId-1]|, which represents the result of
-   * reducing everything in the input array prior to the slice.
-   *
-   * To continue with our example, in phase 1 we computed slice 1 to
-   * be [D, D+E, D+E+F]. We will combine those results with
-   * |intermediates[1-1]|, which is |A+B+C|, so that the final
-   * result is [(A+B+C)+D, (A+B+C)+(D+E), (A+B+C)+(D+E+F)]. Again I
-   * am using parentheses to clarify how these results were reduced.
-   *
-   * SUBTLE: Because we are mutating |buffer| in place, we have to
-   * be very careful about bailouts!  We cannot checkpoint a chunk
-   * at a time as we do elsewhere because that assumes it is safe to
-   * replay the portion of a chunk which was already processed.
-   * Therefore, in this phase, we track the current position at an
-   * index granularity, although this requires two memory writes per
-   * index.
-   */
-  function phase2(sliceId, numSlices, warmup) {
-    if (sliceId == 0)
-      return true; // No work to do for the 0th slice.
-
-    var indexPos = info[SLICE_POS(sliceId)];
-    var indexEnd = info[SLICE_END(sliceId)];
-
-    if (warmup)
-      indexEnd = std_Math_min(indexEnd, indexPos + CHUNK_SIZE);
-
-    var intermediate = intermediates[sliceId - 1];
-    for (; indexPos < indexEnd; indexPos++) {
-      UnsafePutElements(buffer, indexPos, func(intermediate, buffer[indexPos]),
-                        info, SLICE_POS(sliceId), indexPos + 1);
-    }
-
-    return indexEnd == info[SLICE_END(sliceId)];
-  }
-
-  return undefined;
-}
-
-/**
- * |scatter()| redistributes the elements in the parallel array
- * into a new parallel array.
- *
- * - targets: The index targets[i] indicates where the ith element
- *   should appear in the result.
- *
- * - defaultValue: what value to use for indices in the output array that
- *   are never targeted.
- *
- * - conflictFunc: The conflict function. Used to resolve what
- *   happens if two indices i and j in the source array are targeted
- *   as the same destination (i.e., targets[i] == targets[j]), then
- *   the final result is determined by applying func(targets[i],
- *   targets[j]). If no conflict function is provided, it is an error
- *   if targets[i] == targets[j].
- *
- * - length: length of the output array (if not specified, uses the
- *   length of the input).
- *
- * - mode: internal debugging specification.
- */
-function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check targets is array-like
-  // FIXME(bug 844887): Check |IsCallable(conflictFunc)|
-
-  var self = this;
-
-  if (length === undefined)
-    length = self.shape[0];
-
-  // The Divide-Scatter-Vector strategy:
-  // 1. Slice |targets| array of indices ("scatter-vector") into N
-  //    parts.
-  // 2. Each of the N threads prepares an output buffer and a
-  //    write-log.
-  // 3. Each thread scatters according to one of the N parts into its
-  //    own output buffer, tracking written indices in the write-log
-  //    and resolving any resulting local collisions in parallel.
-  // 4. Merge the parts (either in parallel or sequentially), using
-  //    the write-logs as both the basis for finding merge-inputs and
-  //    for detecting collisions.
-
-  // The Divide-Output-Range strategy:
-  // 1. Slice the range of indices [0..|length|-1] into N parts.
-  //    Allocate a single shared output buffer of length |length|.
-  // 2. Each of the N threads scans (the entirety of) the |targets|
-  //    array, seeking occurrences of indices from that thread's part
-  //    of the range, and writing the results into the shared output
-  //    buffer.
-  // 3. Since each thread has its own portion of the output range,
-  //    every collision that occurs can be handled thread-locally.
-
-  // SO:
-  //
-  // If |targets.length| >> |length|, Divide-Scatter-Vector seems like
-  // a clear win over Divide-Output-Range, since for the latter, the
-  // expense of redundantly scanning the |targets| will diminish the
-  // gain from processing |length| in parallel, while for the former,
-  // the total expense of building separate output buffers and the
-  // merging post-process is small compared to the gain from
-  // processing |targets| in parallel.
-  //
-  // If |targets.length| << |length|, then Divide-Output-Range seems
-  // like it *could* win over Divide-Scatter-Vector. (But when is
-  // |targets.length| << |length| or even |targets.length| < |length|?
-  // Seems like an odd situation and an uncommon case at best.)
-  //
-  // The unanswered question is which strategy performs better when
-  // |targets.length| approximately equals |length|, especially for
-  // special cases like collision-free scatters and permutations.
-
-  var targetsLength = std_Math_min(targets.length, self.shape[0]);
-
-  if (targetsLength >>> 0 !== targetsLength)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, ".prototype.scatter length");
-
-  if (length >>> 0 !== length)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, ".prototype.scatter length");
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    if (forceDivideScatterVector())
-      return parDivideScatterVector();
-    else if (forceDivideOutputRange())
-      return parDivideOutputRange();
-    else if (conflictFunc === undefined && targetsLength < length)
-      return parDivideOutputRange();
-    return parDivideScatterVector();
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  return seq();
-
-  function forceDivideScatterVector() {
-    return mode && mode.strategy && mode.strategy == "divide-scatter-vector";
-  }
-
-  function forceDivideOutputRange() {
-    return mode && mode.strategy && mode.strategy == "divide-output-range";
-  }
-
-  function collide(elem1, elem2) {
-    if (conflictFunc === undefined)
-      ThrowError(JSMSG_PAR_ARRAY_SCATTER_CONFLICT);
-
-    return conflictFunc(elem1, elem2);
-  }
-
-
-  function parDivideOutputRange() {
-    var chunks = ComputeNumChunks(targetsLength);
-    var numSlices = ForkJoinSlices();
-    var checkpoints = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++)
-      UnsafePutElements(checkpoints, i, 0);
-
-    var buffer = NewDenseArray(length);
-    var conflicts = NewDenseArray(length);
-
-    for (var i = 0; i < length; i++) {
-      UnsafePutElements(buffer, i, defaultValue);
-      UnsafePutElements(conflicts, i, false);
-    }
-
-    ForkJoin(fill, ForkJoinMode(mode));
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-
-    function fill(sliceId, numSlices, warmup) {
-      var indexPos = checkpoints[sliceId];
-      var indexEnd = targetsLength;
-      if (warmup)
-        indexEnd = std_Math_min(indexEnd, indexPos + CHUNK_SIZE);
-
-      // Range in the output for which we are responsible:
-      var [outputStart, outputEnd] = ComputeSliceBounds(length, sliceId, numSlices);
-
-      for (; indexPos < indexEnd; indexPos++) {
-        var x = self.get(indexPos);
-        var t = checkTarget(indexPos, targets[indexPos]);
-        if (t < outputStart || t >= outputEnd)
-          continue;
-        if (conflicts[t])
-          x = collide(x, buffer[t]);
-        UnsafePutElements(buffer, t, x, conflicts, t, true, checkpoints, sliceId, indexPos + 1);
-      }
-
-      return indexEnd == targetsLength;
-    }
-
-    return undefined;
-  }
-
-  function parDivideScatterVector() {
-    // Subtle: because we will be mutating the localBuffers and
-    // conflict arrays in place, we can never replay an entry in the
-    // target array for fear of inducing a conflict where none existed
-    // before. Therefore, we must proceed not by chunks but rather by
-    // individual indices.
-    var numSlices = ForkJoinSlices();
-    var info = ComputeAllSliceBounds(targetsLength, numSlices);
-
-    // FIXME(bug 844890): Use typed arrays here.
-    var localBuffers = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++)
-      UnsafePutElements(localBuffers, i, NewDenseArray(length));
-    var localConflicts = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++) {
-      var conflicts_i = NewDenseArray(length);
-      for (var j = 0; j < length; j++)
-        UnsafePutElements(conflicts_i, j, false);
-      UnsafePutElements(localConflicts, i, conflicts_i);
-    }
-
-    // Initialize the 0th buffer, which will become the output. For
-    // the other buffers, we track which parts have been written to
-    // using the conflict buffer so they do not need to be
-    // initialized.
-    var outputBuffer = localBuffers[0];
-    for (var i = 0; i < length; i++)
-      UnsafePutElements(outputBuffer, i, defaultValue);
-
-    ForkJoin(fill, ForkJoinMode(mode));
-    mergeBuffers();
-    return NewParallelArray(ParallelArrayView, [length], outputBuffer, 0);
-
-    function fill(sliceId, numSlices, warmup) {
-      var indexPos = info[SLICE_POS(sliceId)];
-      var indexEnd = info[SLICE_END(sliceId)];
-      if (warmup)
-        indexEnd = std_Math_min(indexEnd, indexPos + CHUNK_SIZE);
-
-      var localbuffer = localBuffers[sliceId];
-      var conflicts = localConflicts[sliceId];
-      while (indexPos < indexEnd) {
-        var x = self.get(indexPos);
-        var t = checkTarget(indexPos, targets[indexPos]);
-        if (conflicts[t])
-          x = collide(x, localbuffer[t]);
-        UnsafePutElements(localbuffer, t, x, conflicts, t, true, 
-                          info, SLICE_POS(sliceId), ++indexPos);
-      }
-
-      return indexEnd == info[SLICE_END(sliceId)];
-    }
-
-    /**
-     * Merge buffers 1..NUMSLICES into buffer 0. In principle, we could
-     * parallelize the merge work as well. But for this first cut,
-     * just do the merge sequentially.
-     */
-    function mergeBuffers() {
-      var buffer = localBuffers[0];
-      var conflicts = localConflicts[0];
-      for (var i = 1; i < numSlices; i++) {
-        var otherbuffer = localBuffers[i];
-        var otherconflicts = localConflicts[i];
-        for (var j = 0; j < length; j++) {
-          if (otherconflicts[j]) {
-            if (conflicts[j]) {
-              buffer[j] = collide(otherbuffer[j], buffer[j]);
-            } else {
-              buffer[j] = otherbuffer[j];
-              conflicts[j] = true;
-            }
-          }
-        }
-      }
-    }
-
-    return undefined;
-  }
-
-  function seq() {
-    var buffer = NewDenseArray(length);
-    var conflicts = NewDenseArray(length);
-
-    for (var i = 0; i < length; i++) {
-      UnsafePutElements(buffer, i, defaultValue);
-      UnsafePutElements(conflicts, i, false);
-    }
-
-    for (var i = 0; i < targetsLength; i++) {
-      var x = self.get(i);
-      var t = checkTarget(i, targets[i]);
-      if (conflicts[t])
-        x = collide(x, buffer[t]);
-
-      UnsafePutElements(buffer, t, x, conflicts, t, true);
-    }
-
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-  }
-
-  function checkTarget(i, t) {
-    if (TO_INT32(t) !== t)
-      ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i);
-
-    if (t < 0 || t >= length)
-      ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS);
-
-    // It's not enough to return t, as -0 | 0 === -0.
-    return TO_INT32(t);
-  }
-
-  return undefined;
-}
-
-/**
- * The familiar filter() operation applied across the outermost
- * dimension.
- */
-function ParallelArrayFilter(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    if (chunks < numSlices * 2)
-      break parallel;
-
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-
-    // Step 1. Compute which items from each slice of the result
-    // buffer should be preserved. When we're done, we have an array
-    // |survivors| containing a bitset for each chunk, indicating
-    // which members of the chunk survived. We also keep an array
-    // |counts| containing the total number of items that are being
-    // preserved from within one slice.
-    //
-    // FIXME(bug 844890): Use typed arrays here.
-    var counts = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++)
-      UnsafePutElements(counts, i, 0);
-    var survivors = NewDenseArray(chunks);
-    ForkJoin(findSurvivorsInSlice, ForkJoinMode(mode));
-
-    // Step 2. Compress the slices into one contiguous set.
-    var count = 0;
-    for (var i = 0; i < numSlices; i++)
-      count += counts[i];
-    var buffer = NewDenseArray(count);
-    if (count > 0)
-      ForkJoin(copySurvivorsInSlice, ForkJoinMode(mode));
-
-    return NewParallelArray(ParallelArrayView, [count], buffer, 0);
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  var buffer = [];
-  for (var i = 0; i < length; i++) {
-    var elem = self.get(i);
-    if (func(elem, i, self))
-      ARRAY_PUSH(buffer, elem);
-  }
-  return NewParallelArray(ParallelArrayView, [buffer.length], buffer, 0);
-
-  /**
-   * As described above, our goal is to determine which items we
-   * will preserve from a given slice. We do this one chunk at a
-   * time. When we finish a chunk, we record our current count and
-   * the next chunk sliceId, lest we should bail.
-   */
-  function findSurvivorsInSlice(sliceId, numSlices, warmup) {
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos)
-      chunkEnd = chunkPos + 1;
-
-    var count = counts[sliceId];
-    while (chunkPos < chunkEnd) {
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      var chunkBits = 0;
-
-      for (var bit = 0; indexStart + bit < indexEnd; bit++) {
-        var keep = !!func(self.get(indexStart + bit), indexStart + bit, self);
-        chunkBits |= keep << bit;
-        count += keep;
-      }
-
-      UnsafePutElements(survivors, chunkPos, chunkBits,
-                        counts, sliceId, count,
-                        info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  function copySurvivorsInSlice(sliceId, numSlices, warmup) {
-    // Copies the survivors from this slice into the correct position.
-    // Note that this is an idempotent operation that does not invoke
-    // user code. Therefore, we don't expect bailouts and make an
-    // effort to proceed chunk by chunk or avoid duplicating work.
-
-    // Total up the items preserved by previous slices.
-    var count = 0;
-    if (sliceId > 0) { // FIXME(#819219)---work around a bug in Ion's range checks
-      for (var i = 0; i < sliceId; i++)
-        count += counts[i];
-    }
-
-    // Compute the final index we expect to write.
-    var total = count + counts[sliceId];
-    if (count == total)
-      return true;
-
-    // Iterate over the chunks assigned to us. Read the bitset for
-    // each chunk. Copy values where a 1 appears until we have
-    // written all the values that we expect to. We can just iterate
-    // from 0...CHUNK_SIZE without fear of a truncated final chunk
-    // because we are already checking for when count==total.
-    var chunkStart = info[SLICE_START(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-    for (var chunk = chunkStart; chunk < chunkEnd; chunk++) {
-      var chunkBits = survivors[chunk];
-      if (!chunkBits)
-        continue;
-
-      var indexStart = chunk << CHUNK_SHIFT;
-      for (var i = 0; i < CHUNK_SIZE; i++) {
-        if (chunkBits & (1 << i)) {
-          UnsafePutElements(buffer, count++, self.get(indexStart + i));
-          if (count == total)
-            break;
-        }
-      }
-    }
-
-    return true;
-  }
-
-  return undefined;
-}
-
-/**
- * Divides the outermost dimension into two dimensions. Does not copy
- * or affect the underlying data, just how it is divided amongst
- * dimensions. So if we had a vector with shape [N, ...] and you
- * partition with amount=4, you get a [N/4, 4, ...] vector. Note that
- * N must be evenly divisible by 4 in that case.
- */
-function ParallelArrayPartition(amount) {
-  if (amount >>> 0 !== amount)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-
-  var length = this.shape[0];
-  var partitions = (length / amount) | 0;
-
-  if (partitions * amount !== length)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_PARTITION);
-
-  var shape = [partitions, amount];
-  for (var i = 1; i < this.shape.length; i++)
-    ARRAY_PUSH(shape, this.shape[i]);
-  return NewParallelArray(ParallelArrayView, shape, this.buffer, this.offset);
-}
-
-/**
- * Collapses two outermost dimensions into one. So if you had
- * a [X, Y, ...] vector, you get a [X*Y, ...] vector.
- */
-function ParallelArrayFlatten() {
-  if (this.shape.length < 2)
-    ThrowError(JSMSG_PAR_ARRAY_ALREADY_FLAT);
-
-  var shape = [this.shape[0] * this.shape[1]];
-  for (var i = 2; i < this.shape.length; i++)
-    ARRAY_PUSH(shape, this.shape[i]);
-  return NewParallelArray(ParallelArrayView, shape, this.buffer, this.offset);
-}
-
-//
-// Accessors and utilities.
-//
-
-/**
- * Specialized variant of get() for one-dimensional case
- */
-function ParallelArrayGet1(i) {
-  if (i === undefined)
-    return undefined;
-  return this.buffer[this.offset + i];
-}
-
-/**
- * Specialized variant of get() for two-dimensional case
- */
-function ParallelArrayGet2(x, y) {
-  var xDimension = this.shape[0];
-  var yDimension = this.shape[1];
-  if (x === undefined)
-    return undefined;
-  if (x >= xDimension)
-    return undefined;
-  if (y === undefined)
-    return NewParallelArray(ParallelArrayView, [yDimension], this.buffer, this.offset + x * yDimension);
-  if (y >= yDimension)
-    return undefined;
-  var offset = y + x * yDimension;
-  return this.buffer[this.offset + offset];
-}
-
-/**
- * Specialized variant of get() for three-dimensional case
- */
-function ParallelArrayGet3(x, y, z) {
-  var xDimension = this.shape[0];
-  var yDimension = this.shape[1];
-  var zDimension = this.shape[2];
-  if (x === undefined)
-    return undefined;
-  if (x >= xDimension)
-    return undefined;
-  if (y === undefined)
-    return NewParallelArray(ParallelArrayView, [yDimension, zDimension],
-                            this.buffer, this.offset + x * yDimension * zDimension);
-  if (y >= yDimension)
-    return undefined;
-  if (z === undefined)
-    return NewParallelArray(ParallelArrayView, [zDimension],
-                            this.buffer, this.offset + y * zDimension + x * yDimension * zDimension);
-  if (z >= zDimension)
-    return undefined;
-  var offset = z + y*zDimension + x * yDimension * zDimension;
-  return this.buffer[this.offset + offset];
-}
-
-/**
- * Generalized version of get() for N-dimensional case
- */
-function ParallelArrayGetN(...coords) {
-  if (coords.length == 0)
-    return undefined;
-
-  var products = ComputeProducts(this.shape);
-
-  // Compute the offset of the given coordinates. Each index is
-  // multipled by its corresponding entry in the |products|
-  // array, counting in reverse. So if |coords| is [a,b,c,d],
-  // then you get |a*BCD + b*CD + c*D + d|.
-  var offset = this.offset;
-  var sDimensionality = this.shape.length;
-  var cDimensionality = coords.length;
-  for (var i = 0; i < cDimensionality; i++) {
-    if (coords[i] >= this.shape[i])
-      return undefined;
-    offset += coords[i] * products[sDimensionality - i - 1];
-  }
-
-  if (cDimensionality < sDimensionality) {
-    var shape = callFunction(std_Array_slice, this.shape, cDimensionality);
-    return NewParallelArray(ParallelArrayView, shape, this.buffer, offset);
-  }
-  return this.buffer[offset];
-}
-
-/** The length property yields the outermost dimension */
-function ParallelArrayLength() {
-  return this.shape[0];
-}
-
-function ParallelArrayToString() {
-  var l = this.length;
-  if (l == 0)
-    return "";
-
-  var open, close;
-  if (this.shape.length > 1) {
-    open = "<";
-    close = ">";
-  } else {
-    open = close = "";
-  }
-
-  var result = "";
-  for (var i = 0; i < l - 1; i++) {
-    result += open + String(this.get(i)) + close;
-    result += ",";
-  }
-  result += open + String(this.get(l - 1)) + close;
-  return result;
-}
-
-/**
- * Internal debugging tool: checks that the given `mode` permits
- * sequential execution
- */
-function AssertSequentialIsOK(mode) {
-  if (mode && mode.mode && mode.mode !== "seq" && ParallelTestsShouldPass())
-    ThrowError(JSMSG_WRONG_VALUE, "parallel execution", "sequential was forced");
-}
-
-function ForkJoinMode(mode) {
-  // WARNING: this must match the enum ForkJoinMode in ForkJoin.cpp
-  if (!mode || !mode.mode) {
-    return 0;
-  } else if (mode.mode === "compile") {
-    return 1;
-  } else if (mode.mode === "par") {
-    return 2;
-  } else if (mode.mode === "recover") {
-    return 3;
-  } else if (mode.mode === "bailout") {
-    return 4;
-  }
-  ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-  return undefined;
-}
-
-/*
- * Mark the main operations as clone-at-callsite for better precision.
- * This is slightly overkill, as all that we really need is to
- * specialize to the receiver and the elemental function, but in
- * practice this is likely not so different, since element functions
- * are often used in exactly one place.
- */
-SetScriptHints(ParallelArrayConstructEmpty, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromArray, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromFunction, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromFunctionMode, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromComprehension, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayView,       { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayBuild,      { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayMap,        { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayReduce,     { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayScan,       { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayScatter,    { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayFilter,     { cloneAtCallsite: true });
-
-/*
- * Mark the common getters as clone-at-callsite and inline. This is
- * overkill as we should only clone per receiver, but we have no
- * mechanism for that right now. Bug 804767 might permit another
- * alternative by specializing the inlined gets.
- */
-SetScriptHints(ParallelArrayGet1,       { cloneAtCallsite: true, inline: true });
-SetScriptHints(ParallelArrayGet2,       { cloneAtCallsite: true, inline: true });
-SetScriptHints(ParallelArrayGet3,       { cloneAtCallsite: true, inline: true });
diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js
index 77873cf58acf..8dceb836a257 100644
--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@@ -161,3 +161,33 @@ function IsObject(v) {
            typeof v === "function" ||
            (typeof v === "undefined" && v !== undefined);
 }
+
+#ifdef ENABLE_PARALLEL_JS
+
+/**
+ * Internal debugging tool: checks that the given `mode` permits
+ * sequential execution
+ */
+function AssertSequentialIsOK(mode) {
+  if (mode && mode.mode && mode.mode !== "seq" && ParallelTestsShouldPass())
+    ThrowError(JSMSG_WRONG_VALUE, "parallel execution", "sequential was forced");
+}
+
+function ForkJoinMode(mode) {
+  // WARNING: this must match the enum ForkJoinMode in ForkJoin.cpp
+  if (!mode || !mode.mode) {
+    return 0;
+  } else if (mode.mode === "compile") {
+    return 1;
+  } else if (mode.mode === "par") {
+    return 2;
+  } else if (mode.mode === "recover") {
+    return 3;
+  } else if (mode.mode === "bailout") {
+    return 4;
+  }
+  ThrowError(JSMSG_PAR_ARRAY_BAD_ARG);
+  return undefined;
+}
+
+#endif
diff --git a/js/src/jit-test/lib/parallelarray-helpers.js b/js/src/jit-test/lib/parallelarray-helpers.js
index a6afc03b07ef..9fdc4cea0b1f 100644
--- a/js/src/jit-test/lib/parallelarray-helpers.js
+++ b/js/src/jit-test/lib/parallelarray-helpers.js
@@ -79,13 +79,7 @@ function assertAlmostEq(v1, v2) {
 }
 
 function assertStructuralEq(e1, e2) {
-    if (e1 instanceof ParallelArray && e2 instanceof ParallelArray) {
-      assertEqParallelArray(e1, e2);
-    } else if (e1 instanceof Array && e2 instanceof ParallelArray) {
-      assertEqParallelArrayArray(e2, e1);
-    } else if (e1 instanceof ParallelArray && e2 instanceof Array) {
-      assertEqParallelArrayArray(e1, e2);
-    } else if (e1 instanceof Array && e2 instanceof Array) {
+    if (e1 instanceof Array && e2 instanceof Array) {
       assertEqArray(e1, e2);
     } else if (e1 instanceof Object && e2 instanceof Object) {
       assertEq(e1.__proto__, e2.__proto__);
@@ -100,19 +94,6 @@ function assertStructuralEq(e1, e2) {
     }
 }
 
-function assertEqParallelArrayArray(a, b) {
-  assertEq(a.shape.length, 1);
-  assertEq(a.length, b.length);
-  for (var i = 0, l = a.length; i < l; i++) {
-    try {
-      assertStructuralEq(a.get(i), b[i]);
-    } catch (e) {
-      print("...in index ", i, " of ", l);
-      throw e;
-    }
-  }
-}
-
 function assertEqArray(a, b) {
     assertEq(a.length, b.length);
     for (var i = 0, l = a.length; i < l; i++) {
@@ -125,37 +106,6 @@ function assertEqArray(a, b) {
     }
 }
 
-function assertEqParallelArray(a, b) {
-  assertEq(a instanceof ParallelArray, true);
-  assertEq(b instanceof ParallelArray, true);
-
-  var shape = a.shape;
-  assertEqArray(shape, b.shape);
-
-  function bump(indices) {
-    var d = indices.length - 1;
-    while (d >= 0) {
-      if (++indices[d] < shape[d])
-        break;
-      indices[d] = 0;
-      d--;
-    }
-    return d >= 0;
-  }
-
-  var iv = shape.map(function () { return 0; });
-  do {
-    try {
-      var e1 = a.get.apply(a, iv);
-      var e2 = b.get.apply(b, iv);
-      assertStructuralEq(e1, e2);
-    } catch (e) {
-      print("...in indices ", iv, " of ", shape);
-      throw e;
-    }
-  } while (bump(iv));
-}
-
 // Checks that whenever we execute this in parallel mode,
 // it bails out. `opFunction` should be a closure that takes a
 // mode parameter and performs some parallel array operation.
@@ -164,10 +114,10 @@ function assertEqParallelArray(a, b) {
 // Here is an example of the expected usage:
 //
 //    assertParallelExecWillBail(function(m) {
-//        new ParallelArray(..., m)
+//        Array.buildPar(..., m)
 //    });
 //
-// where the `new ParallelArray(...)` is a stand-in
+// where the `Array.buildPar(...)` is a stand-in
 // for some parallel array operation.
 function assertParallelExecWillBail(opFunction) {
   opFunction({mode:"compile"}); // get the script compiled
@@ -236,30 +186,6 @@ function assertArraySeqParResultsEq(arr, op, func, cmpFunc) {
     function (r) { cmpFunc(expected, r); });
 }
 
-// Compares a ParallelArray function against its equivalent on the
-// `Array` prototype. `func` should be the closure to provide as
-// argument. For example:
-//
-//    compareAgainstArray([1, 2, 3], "map", i => i + 1)
-//
-// would check that `[1, 2, 3].map(i => i+1)` and `new
-// ParallelArray([1, 2, 3]).map(i => i+1)` yield the same result.
-//
-// Based on `assertParallelExecSucceeds`
-function compareAgainstArray(jsarray, opname, func, cmpFunction) {
-  if (!cmpFunction)
-    cmpFunction = assertStructuralEq;
-  var expected = jsarray[opname].apply(jsarray, [func]);
-  var parray = new ParallelArray(jsarray);
-  assertParallelExecSucceeds(
-    function(m) {
-      return parray[opname].apply(parray, [func, m]);
-    },
-    function(r) {
-      cmpFunction(expected, r);
-    });
-}
-
 // Similar to `compareAgainstArray`, but for the `scan` method which
 // does not appear on array.
 function testArrayScanPar(jsarray, func, cmpFunction) {
@@ -281,24 +207,6 @@ function testArrayScanPar(jsarray, func, cmpFunction) {
     });
 }
 
-// Similar to `compareAgainstArray`, but for the `scatter` method.
-// In this case, because scatter is so complex, we do not attempt
-// to compute the expected result and instead simply invoke
-// `cmpFunction(r)` with the result `r` of the scatter operation.
-function testScatter(opFunction, cmpFunction) {
-  var strategies = ["divide-scatter-version", "divide-output-range"];
-  for (var i in strategies) {
-    assertParallelExecSucceeds(
-      function(m) {
-        var m1 = {mode: m.mode,
-                  strategy: strategies[i]};
-        print(JSON.stringify(m1));
-        return opFunction(m1);
-      },
-      cmpFunction);
-  }
-}
-
 // Checks that `opFunction`, when run with each of the modes
 // in `modes`, returns the same value each time.
 function assertParallelModesCommute(modes, opFunction) {
diff --git a/js/src/jit-test/tests/auto-regress/bug755564.js b/js/src/jit-test/tests/auto-regress/bug755564.js
deleted file mode 100644
index e692508ce1b1..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug755564.js
+++ /dev/null
@@ -1,9 +0,0 @@
-// Binary: cache/js-dbg-64-50177d59c0e1-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; });
-  assertEq(r.toString( 5 ? r : 0, gc()) ,[4,2,9,4,5].join(","));
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug783923.js b/js/src/jit-test/tests/auto-regress/bug783923.js
deleted file mode 100644
index 661c77b47972..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug783923.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Binary: cache/js-dbg-64-35b8d6ef5d46-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS)
-  print(ParallelArray());
diff --git a/js/src/jit-test/tests/auto-regress/bug784011.js b/js/src/jit-test/tests/auto-regress/bug784011.js
deleted file mode 100644
index e419fcb9f6c6..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug784011.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Binary: cache/js-dbg-64-c676b554c7bb-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  var p2 = new ParallelArray([2,2], function(i,j) { return i+j; });
-  p2.get({ 0: 1, 1: 0, testGet: 2 })
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug786106.js b/js/src/jit-test/tests/auto-regress/bug786106.js
deleted file mode 100644
index ab0f84f18080..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug786106.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Binary: cache/js-dbg-64-92b9b2840a79-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  var p = new ParallelArray([2, 3,, 4, 5, 6]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; });
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug789107.js b/js/src/jit-test/tests/auto-regress/bug789107.js
deleted file mode 100644
index 9998513cd19e..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug789107.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Binary: cache/js-dbg-64-5d63594c05a9-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  ParallelArray().watch("shape", function() {})
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug791445.js b/js/src/jit-test/tests/auto-regress/bug791445.js
deleted file mode 100644
index a7a3a3a10931..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug791445.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Binary: cache/js-dbg-64-9fff2012b66c-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  ParallelArray(0, Proxy.createFunction(function(){}, function(){}))
-}
diff --git a/js/src/jit-test/tests/baseline/bug846072.js b/js/src/jit-test/tests/baseline/bug846072.js
deleted file mode 100644
index 368e0f03c6e3..000000000000
--- a/js/src/jit-test/tests/baseline/bug846072.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// |jit-test| error: TypeError
-if (getBuildConfiguration().parallelJS) {
-  toString = undefined;
-  if (!(this in ParallelArray)) {}
-} else {
-  throw new TypeError();
-}
diff --git a/js/src/jit-test/tests/baseline/bug857579.js b/js/src/jit-test/tests/baseline/bug857579.js
deleted file mode 100644
index 117e76c25747..000000000000
--- a/js/src/jit-test/tests/baseline/bug857579.js
+++ /dev/null
@@ -1,22 +0,0 @@
-// |jit-test| ion-eager; error: TypeError
-
-function testMonitorIntrinsic() {
-  var N = 2;
-  // Make an NxN array of zeros.
-  var p = new ParallelArray([N,N], function () 0);
-  // |i| will go out of bounds!
-  for (var i = 0; i < N+1; i++) {
-    for (var j = 0; j < 2; j++) {
-      // When |i| goes out of bounds, we will bail from Ion to BC on an
-      // 'undefined' result inside parallel array's .get, tripping a type
-      // barrier on GETINTRINSIC.
-      p.get(i).get(j);
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS) {
-  testMonitorIntrinsic();
-} else {
-  throw new TypeError();
-}
diff --git a/js/src/jit-test/tests/basic/bug815652.js b/js/src/jit-test/tests/basic/bug815652.js
deleted file mode 100644
index ad2b9ad86c65..000000000000
--- a/js/src/jit-test/tests/basic/bug815652.js
+++ /dev/null
@@ -1,12 +0,0 @@
-
-gczeal(9, 2)
-function testScatterConflict() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,(0)], 9, function (a,b) { return a+b; });
-  function assertEqParallelArray(a, b)
-    assertEq(a instanceof ParallelArray, true);
-  assertEqParallelArray(r, new ParallelArray([4,2,(false),4,5]));
-}
-if (getBuildConfiguration().parallelJS) {
-  testScatterConflict();
-}
diff --git a/js/src/jit-test/tests/parallel/binary-arith-numbers.js b/js/src/jit-test/tests/parallel/binary-arith-numbers.js
index 72d3a069f717..cc3a2e5a6397 100644
--- a/js/src/jit-test/tests/parallel/binary-arith-numbers.js
+++ b/js/src/jit-test/tests/parallel/binary-arith-numbers.js
@@ -18,12 +18,11 @@ function theTest() {
   jsarray0.map(op);
 
   // this version will never actually touch the strings:
-  var jsarray1 = range(0, 1024).map(i => i % 10);
-  compareAgainstArray(jsarray1, "map", op);
+  assertArraySeqParResultsEq(range(0, 1024), "map", function (i) { return i % 10; });
 
   // but if we try against the original we get bailouts:
   assertParallelExecWillBail(function (mode) {
-    new ParallelArray(jsarray0).map(op, mode);
+    jsarray0.mapPar(op, mode);
   });
 }
 
diff --git a/js/src/jit-test/tests/parallel/bug783924.js b/js/src/jit-test/tests/parallel/bug783924.js
deleted file mode 100644
index 2ca003d4a0c0..000000000000
--- a/js/src/jit-test/tests/parallel/bug783924.js
+++ /dev/null
@@ -1,7 +0,0 @@
-function bug783924() {
-  // Shouldn't throw.
-  Function("ParallelArray([])")();
-}
-
-if (getBuildConfiguration().parallelJS)
-  bug783924();
diff --git a/js/src/jit-test/tests/parallel/bug787282.js b/js/src/jit-test/tests/parallel/bug787282.js
deleted file mode 100644
index e8848c618501..000000000000
--- a/js/src/jit-test/tests/parallel/bug787282.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// |jit-test| error: TypeError
-
-var protoArr = Proxy.create({}, null);
-void (Array.prototype.__proto__ = protoArr);
-gczeal(2);
-function testCopyBigArray() {
-  var a = new Array(10000);
-  for (var cnt = 0; cnt < a.length; cnt+=2) {
-    var p = new ParallelArray(a);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testCopyBigArray();
-else
-  throw new TypeError();
diff --git a/js/src/jit-test/tests/parallel/bug853555.js b/js/src/jit-test/tests/parallel/bug853555.js
deleted file mode 100644
index 49338c2c3298..000000000000
--- a/js/src/jit-test/tests/parallel/bug853555.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function test() {
-  Object.prototype[0] = /a/;
-  function getterFunction(v) { return "getter"; }
-  Object.defineProperty(Array.prototype, 1, { get: getterFunction });
-  gczeal(4);
-  var p = new ParallelArray([1,2,3,4,5]);
-  p.scatter([0,1,0,3,01], 9, function (a,b) { return a+b; });
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
-
diff --git a/js/src/jit-test/tests/parallel/bug853573.js b/js/src/jit-test/tests/parallel/bug853573.js
deleted file mode 100644
index 8024a4269416..000000000000
--- a/js/src/jit-test/tests/parallel/bug853573.js
+++ /dev/null
@@ -1,17 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  var p = Proxy.create({
-    has : function(id) {}
-  });
-  Object.prototype.__proto__ = p;
-    var pa0 = new ParallelArray(range(0, 256));
-    var pa1 = new ParallelArray(256, function (x) {
-      return pa0.map(function(y) {});
-    });
-}
-
-function range(n, m) {
-  var result = [];
-  for (var i = n; i < m; i++)
-    result.push(i);
-  return result;
-}
diff --git a/js/src/jit-test/tests/parallel/bug854021.js b/js/src/jit-test/tests/parallel/bug854021.js
deleted file mode 100644
index 6b73e0bc9600..000000000000
--- a/js/src/jit-test/tests/parallel/bug854021.js
+++ /dev/null
@@ -1,3 +0,0 @@
-// Don't crash.
-if (getBuildConfiguration().parallelJS)
-  ParallelArray(7, function ([y]) {})
diff --git a/js/src/jit-test/tests/parallel/bug854050.js b/js/src/jit-test/tests/parallel/bug854050.js
deleted file mode 100644
index a839b3634b7a..000000000000
--- a/js/src/jit-test/tests/parallel/bug854050.js
+++ /dev/null
@@ -1,10 +0,0 @@
-function bug854050() {
-  // Shouldn't crash. Tests Ion's argumentsRectifier loading the right
-  // IonScript depending on execution mode.
-  for (z = 0; z < 1; z++)
-    function x(b, x) {}
-  ParallelArray(47, x);
-}
-
-if (getBuildConfiguration().parallelJS)
-  bug854050();
diff --git a/js/src/jit-test/tests/parallel/bug854381.js b/js/src/jit-test/tests/parallel/bug854381.js
deleted file mode 100644
index 99c0b1239820..000000000000
--- a/js/src/jit-test/tests/parallel/bug854381.js
+++ /dev/null
@@ -1,20 +0,0 @@
-function bug854381() {
-  // Don't crash.
-  function toString(r) {
-    var l = 2;
-    var result = "";
-    for (var i = 0; i < l; i++)
-      result += r.get(i);
-    return result;
-  }
-
-  var p = new ParallelArray(['x', 'x']);
-  var r = new ParallelArray([toString(p), 42]);
-
-  gc();
-  print(toString(r));
-}
-
-if (getBuildConfiguration().parallelJS) {
-  bug854381();
-}
diff --git a/js/src/jit-test/tests/parallel/bug857846.js b/js/src/jit-test/tests/parallel/bug857846.js
deleted file mode 100644
index 19ef69e25cd1..000000000000
--- a/js/src/jit-test/tests/parallel/bug857846.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function testNegativeZeroScatter() {
-  // Don't crash.
-  var p = new ParallelArray([0]);
-  var r = p.scatter([-0], 0, undefined, 1);
-}
-
-if (getBuildConfiguration().parallelJS) {
-  testNegativeZeroScatter();
-}
diff --git a/js/src/jit-test/tests/parallel/bug858077.js b/js/src/jit-test/tests/parallel/bug858077.js
deleted file mode 100644
index 4af7e467fb34..000000000000
--- a/js/src/jit-test/tests/parallel/bug858077.js
+++ /dev/null
@@ -1,5 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  var a = new ParallelArray([1,2,3,4]);
-  for (var i = 0; i < 9 && i > -1000; i-- )
-    a[i] += [0];
-}
diff --git a/js/src/jit-test/tests/parallel/bug858582.js b/js/src/jit-test/tests/parallel/bug858582.js
deleted file mode 100644
index da3f9df98a32..000000000000
--- a/js/src/jit-test/tests/parallel/bug858582.js
+++ /dev/null
@@ -1,68 +0,0 @@
-// |jit-test| error: TypeError
-// Don't crash.
-if (getBuildConfiguration().parallelJS) {
-gczeal(2);
-evaluate("\
-function assertAlmostEq(v1, v2) {\
-  print(\"v2 = \" + v2);\
-  print(\"% diff = \" + percent);\
-function assertStructuralEq(e1, e2) {}\
-function assertEqParallelArrayArray(a, b) {\
-    try {} catch (e) {\
-      print(\"...in index \", i, \" of \", l);\
-  }\
-}\
-    function assertEqArray(a, b) {\
-      try {} catch (e) {}\
-}\
-function assertEqParallelArray(a, b) {\
-  var shape = a.shape;\
-  function bump(indices) {\
-  var iv = shape.map(function () { return 0; });\
-      print(\"...in indices \", iv, \" of \", shape);\
-    }\
-  } while (bump(iv));\
-}\
-function assertParallelArrayModesEq(modes, acc, opFunction, cmpFunction) {\
-  modes.forEach(function (mode) {\
-    var result = opFunction({ mode: mode, expect: \"success\" });\
-    cmpFunction(acc, result);\
-  });\
-function assertParallelArrayModesCommute(modes, opFunction) {\
-    var acc = opFunction({ mode: modes[0], expect: \"success\" });\
-}\
-function comparePerformance(opts) {\
-        print(\"Option \" + opts[i].name + \" took \" + diff + \"ms\");\
-        print(\"Option \" + opts[i].name + \" relative to option \" +\
-              opts[0].name + \": \" + (rel|0) + \"%\");\
-    }\
-}\
-function compareAgainstArray(jsarray, opname, func, cmpFunction) {\
-  var expected = jsarray[opname].apply(jsarray, [func]);\
-  var parray = new ParallelArray(jsarray);\
-  assertParallelArrayModesEq([\"seq\", \"par\", \"par\"], expected, function(m) {\
-    var result = parray[opname].apply(parray, [func, m]);\
-  }, cmpFunction);\
-}\
-function testFilter(jsarray, func, cmpFunction) {}\
-", { noScriptRval : true });
-  compareAgainstArray([
-	"a", 
-	"b", 
-	('captures: 1,1; RegExp.leftContext: ""; RegExp.rightContext: "123456"'), 
-	"d", "e", 
-	"f", "g", "h",
-        "i", "j", "k", "l", 
-	"m", "n", "o", "p",
-        "q", "r", "s", "t", 
-	(.6  ), "v", "w", "x", "y", "z"
-	], "map", function(e) { 
-		return e != "u" 
-			&& 
-			(function b   (   )  { 
-			} )      
-			!= "x"; 
-	});
-} else {
-  throw new TypeError();
-}
diff --git a/js/src/jit-test/tests/parallel/bug890465.js b/js/src/jit-test/tests/parallel/bug890465.js
deleted file mode 100644
index e47a157c0102..000000000000
--- a/js/src/jit-test/tests/parallel/bug890465.js
+++ /dev/null
@@ -1,6 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  x = Uint8ClampedArray()
-  ParallelArray([320], function() {
-      return x[8]
-  })
-}
diff --git a/js/src/jit-test/tests/parallel/bug894782.js b/js/src/jit-test/tests/parallel/bug894782.js
deleted file mode 100644
index f25875b28320..000000000000
--- a/js/src/jit-test/tests/parallel/bug894782.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Don't crash
-
-if (getBuildConfiguration().parallelJS) {
-  print(ParallelArray())
-  String(Object.create(ParallelArray(8077, function() {})))
-}
diff --git a/js/src/jit-test/tests/parallel/bug895782.js b/js/src/jit-test/tests/parallel/bug895782.js
deleted file mode 100644
index f8538fa6a918..000000000000
--- a/js/src/jit-test/tests/parallel/bug895782.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Don't crash
-
-if (getBuildConfiguration().parallelJS) {
-  Object.defineProperty(this, "y", {
-    get: function() {
-      return Object.create(x)
-    }
-  })
-  x = ParallelArray([1142], function() {})
-  x = x.partition(2)
-  y + y
-}
diff --git a/js/src/jit-test/tests/parallel/bug908939.js b/js/src/jit-test/tests/parallel/bug908939.js
deleted file mode 100644
index d70a27858ad7..000000000000
--- a/js/src/jit-test/tests/parallel/bug908939.js
+++ /dev/null
@@ -1,13 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  x = ParallelArray([9937], function() {
-      return /x/
-      })
-  Object.defineProperty(this, "y", {
-    get: function() {
-      return Object.create(x)
-    }
-  })
-  y + x
-  x = x.scatter([]);
-  + y
-}
diff --git a/js/src/jit-test/tests/parallel/bug909599.js b/js/src/jit-test/tests/parallel/bug909599.js
deleted file mode 100644
index 1dee7caaf61c..000000000000
--- a/js/src/jit-test/tests/parallel/bug909599.js
+++ /dev/null
@@ -1,6 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  x = Math.tan(5) + []
-  ParallelArray([764], (function() {})).filter(function(e) {
-      return e << x
-  })
-}
diff --git a/js/src/jit-test/tests/parallel/compare-values.js b/js/src/jit-test/tests/parallel/compare-values.js
index 398df363b37a..0da90f4fd5e0 100644
--- a/js/src/jit-test/tests/parallel/compare-values.js
+++ b/js/src/jit-test/tests/parallel/compare-values.js
@@ -15,29 +15,29 @@ function theTest() {
     return doubles[i] == e;
   }
   print("doubles");
-  compareAgainstArray(doubles, "map", looselyCompareToDoubles)
+  assertArraySeqParResultsEq(doubles, "map", looselyCompareToDoubles);
   print("bools");
-  compareAgainstArray(bools, "map", looselyCompareToDoubles)
+  assertArraySeqParResultsEq(bools, "map", looselyCompareToDoubles);
   // ion bails out when converting a string to a double right now,
   // so par exec cannot proceed
   print("strings");
   assertParallelExecWillBail(function (mode) {
-    new ParallelArray(strings).map(looselyCompareToDoubles, mode)
+    strings.mapPar(looselyCompareToDoubles, mode)
   });
   print("ints");
-  compareAgainstArray(ints, "map", looselyCompareToDoubles)
+  assertArraySeqParResultsEq(ints, "map", looselyCompareToDoubles);
 
   function strictlyCompareToDoubles(e, i) {
     return doubles[i] === e;
   }
   print("doubles, strict");
-  compareAgainstArray(doubles, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(doubles, "map", strictlyCompareToDoubles);
   print("bools, strict");
-  compareAgainstArray(bools, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(bools, "map", strictlyCompareToDoubles);
   print("strings, strict");
-  compareAgainstArray(strings, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(strings, "map", strictlyCompareToDoubles);
   print("ints, strict");
-  compareAgainstArray(ints, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(ints, "map", strictlyCompareToDoubles);
 }
 
 if (getBuildConfiguration().parallelJS)
diff --git a/js/src/jit-test/tests/parallel/comprehension-2.js b/js/src/jit-test/tests/parallel/comprehension-2.js
deleted file mode 100644
index 4c61faffb271..000000000000
--- a/js/src/jit-test/tests/parallel/comprehension-2.js
+++ /dev/null
@@ -1,13 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-load(libdir + "eqArrayHelper.js");
-
-function buildMultidim() {
-  // 2D comprehension
-  var p = new ParallelArray([2,2], function (i,j) { return i + j; });
-  var a = new ParallelArray([0,1,1,2]).partition(2);
-  assertEqArray(p.shape, [2,2]);
-  assertEqParallelArray(p, a);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildMultidim();
diff --git a/js/src/jit-test/tests/parallel/comprehension-fn-args.js b/js/src/jit-test/tests/parallel/comprehension-fn-args.js
deleted file mode 100644
index bb2004d6f46d..000000000000
--- a/js/src/jit-test/tests/parallel/comprehension-fn-args.js
+++ /dev/null
@@ -1,16 +0,0 @@
-
-function buildComprehension() {
-  // Test kernel function arguments
-  var shape = [];
-  for (var i = 0; i < 8; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () {
-      assertEq(arguments.length, shape.length);
-      for (var j = 0; j < shape.length; j++)
-        assertEq(arguments[j] >= 0 && arguments[j] < shape[j], true);
-    });
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildComprehension();
diff --git a/js/src/jit-test/tests/parallel/comprehension-scale.js b/js/src/jit-test/tests/parallel/comprehension-scale.js
deleted file mode 100644
index d10d01ea8552..000000000000
--- a/js/src/jit-test/tests/parallel/comprehension-scale.js
+++ /dev/null
@@ -1,22 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function buildComprehension() {
-  var H = 96;
-  var W = 96;
-  var d = 4;
-  // 3D 96x96x4 texture-like PA
-  var p = new ParallelArray([H,W,d], function (i,j,k) { return i + j + k; });
-  var a = [];
-  for (var i = 0; i < H; i++) {
-    for (var j = 0; j < W; j++) {
-      for (var k = 0; k < d; k++) {
-        a.push(i+j+k);
-      }
-    }
-  }
-  var p2 = new ParallelArray(a).partition(d).partition(W);
-  assertEqParallelArray(p, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildComprehension();
diff --git a/js/src/jit-test/tests/parallel/constructor-1.js b/js/src/jit-test/tests/parallel/constructor-1.js
deleted file mode 100644
index d5d5160344ad..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-1.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function buildSimple() {
-  // Simple constructor
-  var a = [1,2,3,4,5];
-  var p = new ParallelArray(a);
-  assertEqParallelArrayArray(p, a);
-  var a2 = a.slice();
-  a[0] = 9;
-  // No sharing
-  assertEqParallelArrayArray(p, a2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildSimple();
diff --git a/js/src/jit-test/tests/parallel/constructor-2.js b/js/src/jit-test/tests/parallel/constructor-2.js
deleted file mode 100644
index 38a69b51f2cf..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-2.js
+++ /dev/null
@@ -1,15 +0,0 @@
-
-function buildWithHoles() {
-  // Test holes
-  var a = new Array(5);
-  for (var cnt = 0; cnt < a.length; cnt+=2) {
-      a[cnt] = cnt;
-  }
-  var b = [0,1,2,3,4];
-  var p = new ParallelArray(a);
-  assertEq(Object.keys(p).join(","), Object.keys(b).join(","));
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   buildWithHoles();
diff --git a/js/src/jit-test/tests/parallel/constructor-3.js b/js/src/jit-test/tests/parallel/constructor-3.js
deleted file mode 100644
index 6fc501650a36..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-3.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function bracket(s) {
-  return "<" + s + ">";
-}
-
-function buildArrayLike() {
-  // Construct copying from array-like
-  var a = { 0: 1, 1: 2, 2: 3, 3: 4, length: 4 };
-  var p = new ParallelArray(a);
-  var e = Array.prototype.join.call(a, ",");
-  assertEq(p.toString(), e);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildArrayLike();
diff --git a/js/src/jit-test/tests/parallel/constructor-4.js b/js/src/jit-test/tests/parallel/constructor-4.js
deleted file mode 100644
index 7b435c2eb9df..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-4.js
+++ /dev/null
@@ -1,16 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function buildPA() {
-  // Construct copying from PA
-  var p1 = new ParallelArray([1,2,3,4]);
-  var p2 = new ParallelArray(p1);
-  assertEqParallelArray(p1, p2);
-
-  var p1d = new ParallelArray([2,2], function(i,j) { return i + j; });
-  var p2d = new ParallelArray(p1d);
-  assertEq(p1d.toString(), p2d.toString());
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   buildPA();
diff --git a/js/src/jit-test/tests/parallel/constructor-5.js b/js/src/jit-test/tests/parallel/constructor-5.js
deleted file mode 100644
index 929c80fdabb4..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-5.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// |jit-test| slow;
-// ^^ This test is slow when --no-ion is used, specifically,
-//    as part of TBPL.
-
-function testCopyBigArray() {
-  // Don't crash
-  var a = new Array(1000 * 1000);
-  var p = new ParallelArray(a);
-  // Holes!
-  var a = new Array(10000);
-  for (var cnt = 0; cnt < a.length; cnt+=2) {
-    a[cnt] = cnt;
-    var p = new ParallelArray(a);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testCopyBigArray();
diff --git a/js/src/jit-test/tests/parallel/constructor-throws.js b/js/src/jit-test/tests/parallel/constructor-throws.js
deleted file mode 100644
index 20e760a8c0d8..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-throws.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "asserts.js");
-
-function testThrows() {
-  assertThrowsInstanceOf(function () {
-    new ParallelArray({ length: 0xffffffff + 1 });
-  }, RangeError);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testThrows();
diff --git a/js/src/jit-test/tests/parallel/element-1.js b/js/src/jit-test/tests/parallel/element-1.js
deleted file mode 100644
index a26843aed7fc..000000000000
--- a/js/src/jit-test/tests/parallel/element-1.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function testElement() {
-  // Test getting element from 1D
-  var a = [1,{},"a",false]
-  var p = new ParallelArray(a);
-  for (var i = 0; i < a.length; i++) {
-    assertEq(p.get(i), p.get(i));
-    assertEq(p.get(i), a[i]);
-  }
-  // Test out of bounds
-  assertEq(p.get(42), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testElement();
diff --git a/js/src/jit-test/tests/parallel/element-2.js b/js/src/jit-test/tests/parallel/element-2.js
deleted file mode 100644
index bb23b95f42eb..000000000000
--- a/js/src/jit-test/tests/parallel/element-2.js
+++ /dev/null
@@ -1,26 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testElement() {
-  // Test getting element from higher dimension
-  var p = new ParallelArray([2,2,2], function () { return 0; });
-  var p0 = new ParallelArray([2,2], function () { return 0; });
-  print("0");
-  assertEqParallelArray(p.get(0), p0);
-
-  // Should create new wrapper
-  print("1");
-  assertEq(p.get(0) !== p.get(0), true);
-
-  // Test out of bounds
-  print("2");
-  assertEq(p.get(42), undefined);
-
-  // Test getting element from 0-lengthed higher dimension
-  var pp = new ParallelArray([0,0], function() { return 0; });
-  assertEq(pp.get(2), undefined);
-  var pp2 = new ParallelArray([2,0], function() { return 0; });
-  assertEqParallelArray(pp2.get(0), new ParallelArray());
-}
-
-if (getBuildConfiguration().parallelJS)
-  testElement();
diff --git a/js/src/jit-test/tests/parallel/element-3.js b/js/src/jit-test/tests/parallel/element-3.js
deleted file mode 100644
index 7872d9d001c8..000000000000
--- a/js/src/jit-test/tests/parallel/element-3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function testElement() {
-  var p = new ParallelArray([9]);
-  var desc = Object.getOwnPropertyDescriptor(p, "0");
-  assertEq(desc.enumerable, true);
-  assertEq(desc.configurable, false);
-  assertEq(desc.writable, false);
-  assertEq(desc.value, 9);
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   testElement();
diff --git a/js/src/jit-test/tests/parallel/flatten-1.js b/js/src/jit-test/tests/parallel/flatten-1.js
deleted file mode 100644
index d7d68923e802..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-1.js
+++ /dev/null
@@ -1,14 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testFlatten() {
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function(i,j) { return i+j; });
-    var flatShape = ([shape[0] * shape[1]]).concat(shape.slice(2));
-    assertEqArray(p.flatten().shape, flatShape);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testFlatten();
diff --git a/js/src/jit-test/tests/parallel/flatten-2.js b/js/src/jit-test/tests/parallel/flatten-2.js
deleted file mode 100644
index 7a7249b15e68..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-2.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testFlatten() {
-  var p = new ParallelArray([2,2], function(i,j) { return i+j; });
-  var p2 = new ParallelArray([0,1,1,2]);
-  assertEqParallelArray(p.flatten(), p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testFlatten();
diff --git a/js/src/jit-test/tests/parallel/flatten-3.js b/js/src/jit-test/tests/parallel/flatten-3.js
deleted file mode 100644
index 82967567c12b..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-3.js
+++ /dev/null
@@ -1,25 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testFlatten() {
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2,3]);
-  var p = new ParallelArray([p0, p1]);
-  var p2 = new ParallelArray([0,1,2,3]);
-  assertEqParallelArray(p.flatten(), p2);
-
-  // Test flatten crossing packed boundary with non-shape uniform elements
-  var blah = new ParallelArray([2,2], function() { return 0; });
-  var pp = new ParallelArray([p0, p1, blah]);
-  var p2 = new ParallelArray([0,1,2,3,blah[0],blah[1]]);
-  assertEqParallelArray(pp.flatten(), p2);
-
-  var p0 = new ParallelArray([2,2], function() { return 1; });
-  var p1 = new ParallelArray([2,2], function() { return 2; });
-  var p = new ParallelArray([p0, p1]);
-  var p2 = new ParallelArray([p0[0],p0[1],p1[0],p1[1]]);
-  assertEqParallelArray(p.flatten(), p2);
-}
-
-// FIXME(bug 844991) logical shape not implemented
-// if (getBuildConfiguration().parallelJS)
-//   testFlatten();
diff --git a/js/src/jit-test/tests/parallel/flatten-throws.js b/js/src/jit-test/tests/parallel/flatten-throws.js
deleted file mode 100644
index 47fd1ce3fc5f..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-throws.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// |jit-test| error: Error;
-
-function testFlattenFlat() {
-  // Throw on flattening flat array
-  var p = new ParallelArray([1]);
-  var f = p.flatten();
-}
-
-if (getBuildConfiguration().parallelJS)
-  testFlattenFlat();
-else
-  throw new Error();
diff --git a/js/src/jit-test/tests/parallel/get-1.js b/js/src/jit-test/tests/parallel/get-1.js
deleted file mode 100644
index 5a0c5cfc5146..000000000000
--- a/js/src/jit-test/tests/parallel/get-1.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function testGet() {
-  var a = [1,2,3,4,5];
-  var p = new ParallelArray(a);
-  for (var i = 0; i < a.length; i++)
-    assertEq(p.get(i), a[i]);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGet();
diff --git a/js/src/jit-test/tests/parallel/get-2.js b/js/src/jit-test/tests/parallel/get-2.js
deleted file mode 100644
index 2601f4e1d967..000000000000
--- a/js/src/jit-test/tests/parallel/get-2.js
+++ /dev/null
@@ -1,14 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testGet() {
-  var p = new ParallelArray([2,2,2], function(i,j,k) { return i+j+k; });
-  assertEq(p.get(1,1,1), 1+1+1);
-  var p2 = new ParallelArray([2], function(i) { return 1+1+i; });
-  assertEqParallelArray(p.get(1,1), p2);
-  var p3 = new ParallelArray([2,2], function(i,j) { return 1+i+j; });
-  assertEqParallelArray(p.get(1), p3);
-  assertEq(p.get(5,5), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGet();
diff --git a/js/src/jit-test/tests/parallel/get-3.js b/js/src/jit-test/tests/parallel/get-3.js
deleted file mode 100644
index f548db7fed80..000000000000
--- a/js/src/jit-test/tests/parallel/get-3.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function testGetNoCraziness() {
-  // .get shouldn't do prototype walks
-  ParallelArray.prototype[42] = "foo";
-  var p = new ParallelArray([1,2,3,4]);
-  assertEq(p.get(42), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGetNoCraziness();
diff --git a/js/src/jit-test/tests/parallel/get-4.js b/js/src/jit-test/tests/parallel/get-4.js
deleted file mode 100644
index 96568978e4bf..000000000000
--- a/js/src/jit-test/tests/parallel/get-4.js
+++ /dev/null
@@ -1,7 +0,0 @@
-function testGetBounds() {
-  var p = new ParallelArray([1,2,3,4]);
-  assertEq(p.get(42), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGetBounds();
diff --git a/js/src/jit-test/tests/parallel/get-6.js b/js/src/jit-test/tests/parallel/get-6.js
deleted file mode 100644
index 8d652193612c..000000000000
--- a/js/src/jit-test/tests/parallel/get-6.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function testGet() {
-  // Test getting higher dimension inferred shape
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2,3]);
-  var p = new ParallelArray([p0, p1]);
-  assertEq(p.get(0,0), 0);
-  assertEq(p.get(0,1), 1);
-  assertEq(p.get(1,0), 2);
-  assertEq(p.get(1,1), 3);
-}
-
-// FIXME(bug 844991) logical shape not implemented
-// if (getBuildConfiguration().parallelJS)
-//   testGet();
diff --git a/js/src/jit-test/tests/parallel/holes-1.js b/js/src/jit-test/tests/parallel/holes-1.js
deleted file mode 100644
index d6b21e71ea9b..000000000000
--- a/js/src/jit-test/tests/parallel/holes-1.js
+++ /dev/null
@@ -1,31 +0,0 @@
-function testHoles() {
-  function f1(a) { return a * 42; }
-  function f2(a,b) { return a * b; }
-  // Don't crash when getting holes out.
-  //
-  // We do the multiplications below instead of asserting against undefined to
-  // force the VM to call a conversion function, which will crash if the value
-  // we got out is a JS_ARRAY_HOLE.
-  var p = new ParallelArray([,1]);
-  assertEq(p.get(0) * 42, NaN);
-  var m = p.map(f1);
-  assertEq(m.get(0), NaN);
-  assertEq(m.get(1), 42);
-  var r = p.reduce(f2);
-  assertEq(r, NaN);
-  var s = p.scan(f2);
-  assertEq(s.get(0) * 42, NaN);
-  assertEq(s.get(1), NaN);
-  var k = p.scatter([1,0]);
-  assertEq(k.get(0), 1);
-  assertEq(k[1] * 42, NaN);
-  var l = p.filter(function (e, i) { return i == 0; });
-  assertEq(l.get(0) * 42, NaN);
-  var p2 = p.partition(1);
-  assertEq(p2.get(0).get(0) * 42, NaN);
-  var g = p.get(0);
-  assertEq(g * 42, NaN);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testHoles();
diff --git a/js/src/jit-test/tests/parallel/holes-2.js b/js/src/jit-test/tests/parallel/holes-2.js
deleted file mode 100644
index 161a0001e948..000000000000
--- a/js/src/jit-test/tests/parallel/holes-2.js
+++ /dev/null
@@ -1,25 +0,0 @@
-function testElement() {
-  // No crazy prototype walking for indexed properties
-  ParallelArray.prototype[42] = "foo";
-  ParallelArray.prototype.bar = "bar";
-  var p = new ParallelArray([1,2,3,4]);
-  assertEq(p[42], undefined);
-  assertEq(42 in p, false);
-  assertEq("bar" in p, true);
-  // Don't inherit any indexed properties
-  for (var i in p)
-    assertEq(i !== 42, true);
-  for (var i in p) {
-    if (i % 1 !== 0)
-      assertEq(i, "bar");
-  }
-  ParallelArray.prototype[0] = "foo";
-  var p2 = new ParallelArray([,2]);
-  // ParallelArrays have no holes, so 0 must be 'in' p2
-  assertEq(0 in p2, true);
-  assertEq(p2[0], undefined);
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   testElement();
diff --git a/js/src/jit-test/tests/parallel/index-1.js b/js/src/jit-test/tests/parallel/index-1.js
deleted file mode 100644
index c264c7b68dff..000000000000
--- a/js/src/jit-test/tests/parallel/index-1.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function test() {
-  var N = 22;
-  var p = new ParallelArray([N], function(i) { return i; });
-  for (var i = 0; i < N; i++)
-    assertEq(p.get(i), i);
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/index-2.js b/js/src/jit-test/tests/parallel/index-2.js
deleted file mode 100644
index 385f07157353..000000000000
--- a/js/src/jit-test/tests/parallel/index-2.js
+++ /dev/null
@@ -1,18 +0,0 @@
-function test() {
-  function mk(i, j) { return i*100+j; }
-
-  var N = 22;
-  var M = 44;
-
-  var p = new ParallelArray([N,M], mk);
-  for (var i = 0; i < N; i++) {
-    for (var j = 0; j < M; j++) {
-      print([i, j]);
-      assertEq(p.get(i, j), mk(i, j));
-      assertEq(p.get(i).get(j), mk(i, j));
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/index-3.js b/js/src/jit-test/tests/parallel/index-3.js
deleted file mode 100644
index 9606c24a3831..000000000000
--- a/js/src/jit-test/tests/parallel/index-3.js
+++ /dev/null
@@ -1,25 +0,0 @@
-function test() {
-  function mk(i, j, k) { return i*10000+j*100+k; }
-
-  var N = 10;
-  var M = 20;
-  var O = 30;
-
-  print("Computing");
-  var p = new ParallelArray([N,M,O], mk);
-
-  print("Checking");
-  for (var i = 0; i < N; i++) {
-    for (var j = 0; j < M; j++) {
-      for (var k = 0; k < O; k++) {
-        assertEq(p.get(i, j, k), mk(i, j, k));
-        assertEq(p.get(i, j).get(k), mk(i, j, k));
-        assertEq(p.get(i).get(j).get(k), mk(i, j, k));
-        assertEq(p.get(i).get(j, k), mk(i, j, k));
-      }
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/index-4.js b/js/src/jit-test/tests/parallel/index-4.js
deleted file mode 100644
index 6a1696483139..000000000000
--- a/js/src/jit-test/tests/parallel/index-4.js
+++ /dev/null
@@ -1,27 +0,0 @@
-function test() {
-  function mk(i, j, k, l) { return i*1000000+j*10000+k*100+l; }
-
-  var N = 2;
-  var M = 4;
-  var O = 6;
-  var P = 8;
-
-  print("Computing");
-  var p = new ParallelArray([N,M,O,P], mk);
-
-  print("Checking");
-  for (var i = 0; i < N; i++) {
-    for (var j = 0; j < M; j++) {
-      for (var k = 0; k < O; k++) {
-        for (var l = 0; l < P; l++) {
-          assertEq(p.get(i, j, k, l), mk(i, j, k, l));
-          assertEq(p.get(i, j).get(k, l), mk(i, j, k, l));
-          assertEq(p.get(i).get(j).get(k).get(l), mk(i, j, k, l));
-        }
-      }
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/inline-new-bad-type.js b/js/src/jit-test/tests/parallel/inline-new-bad-type.js
deleted file mode 100644
index df9d1cbc62f7..000000000000
--- a/js/src/jit-test/tests/parallel/inline-new-bad-type.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// |jit-test| error: RangeError
-//
-// Run with --ion-eager.
-if (getBuildConfiguration().parallelJS) {
-  function TestCase(n, d, e, a) {};
-  function reportCompare() {
-    var testcase = new TestCase("x", 0);
-  }
-  reportCompare();
-  TestCase = ParallelArray;
-  gczeal(6);
-  try {
-    reportCompare();
-  } catch(exc1) {}
-  reportCompare();
-} else {
-  throw new RangeError();
-}
diff --git a/js/src/jit-test/tests/parallel/length-1.js b/js/src/jit-test/tests/parallel/length-1.js
deleted file mode 100644
index 20d0656b808f..000000000000
--- a/js/src/jit-test/tests/parallel/length-1.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function testLength() {
-  var a = [1,2,3];
-  var p = new ParallelArray(a);
-  assertEq(p.length, a.length);
-  // Test holes
-  var a = [1,,3];
-  var p = new ParallelArray(a);
-  assertEq(p.length, a.length);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testLength();
diff --git a/js/src/jit-test/tests/parallel/length-2.js b/js/src/jit-test/tests/parallel/length-2.js
deleted file mode 100644
index 8e569abaebc0..000000000000
--- a/js/src/jit-test/tests/parallel/length-2.js
+++ /dev/null
@@ -1,13 +0,0 @@
-function testLength() {
-  // Test higher dimension shape up to 8D
-  var shape = [];
-  for (var i = 0; i < 8; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return 0; });
-    // Length should be outermost dimension
-    assertEq(p.length, shape[0]);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testLength();
diff --git a/js/src/jit-test/tests/parallel/length-3.js b/js/src/jit-test/tests/parallel/length-3.js
deleted file mode 100644
index cb9d9ce519dc..000000000000
--- a/js/src/jit-test/tests/parallel/length-3.js
+++ /dev/null
@@ -1,11 +0,0 @@
-function testLength() {
-  // Test length immutability.
-  var p = new ParallelArray([1,2,3,4]);
-  p.length = 0;
-  assertEq(p[0], 1);
-  assertEq(p.length, 4);
-}
-
-// FIXME(bug 844988) immutability not enforced
-// if (getBuildConfiguration().parallelJS)
-//   testLength();
diff --git a/js/src/jit-test/tests/parallel/mandelbrot.js b/js/src/jit-test/tests/parallel/mandelbrot.js
index 04306bb3dad3..8764399dfb88 100644
--- a/js/src/jit-test/tests/parallel/mandelbrot.js
+++ b/js/src/jit-test/tests/parallel/mandelbrot.js
@@ -46,6 +46,8 @@ var cols = 4;
 if (getBuildConfiguration().parallelJS) {
   var expected = computeSequentially();
   assertParallelExecSucceeds(
-    function (m) new ParallelArray([rows, cols], computeSetByRow, m).flatten(),
+    function (m) Array.buildPar(rows * cols, function (xy) {
+      return computeSetByRow((xy/cols)|0,(xy%cols))
+    }, m),
     function (r) assertStructuralEq(expected, r));
 }
diff --git a/js/src/jit-test/tests/parallel/map-3.js b/js/src/jit-test/tests/parallel/map-3.js
deleted file mode 100644
index f92817fb7706..000000000000
--- a/js/src/jit-test/tests/parallel/map-3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testMap() {
-  // Test mapping higher dimensional
-  var p = new ParallelArray([2,2], function (i,j) { return i+j; });
-  var m = p.map(function(x) { return x; });
-  var p2 = new ParallelArray(p.shape[0], function (i) { return p.get(i); });
-  assertEqParallelArray(m, p2);
-}
-
-if (getBuildConfiguration().parallelJS) testMap();
-
diff --git a/js/src/jit-test/tests/parallel/overflow-throws.js b/js/src/jit-test/tests/parallel/overflow-throws.js
deleted file mode 100644
index 60f5e4264951..000000000000
--- a/js/src/jit-test/tests/parallel/overflow-throws.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "asserts.js");
-
-function testOverflow() {
-  assertThrowsInstanceOf(function () {
-    new ParallelArray([0xffffffff + 1], function() { return 0; });
-  }, RangeError);
-  assertThrowsInstanceOf(function () {
-    new ParallelArray({ length: 0xffffffff + 1 });
-  }, RangeError);
-}
-
-if (getBuildConfiguration().parallelJS) testOverflow();
diff --git a/js/src/jit-test/tests/parallel/partition-1.js b/js/src/jit-test/tests/parallel/partition-1.js
deleted file mode 100644
index 56b5a64d3af9..000000000000
--- a/js/src/jit-test/tests/parallel/partition-1.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testPartition() {
-  var p = new ParallelArray([1,2,3,4,5,6,7,8]);
-  var pp = p.partition(2);
-  var ppp = pp.partition(2);
-  var ppShape = [p.shape[0] / 2, 2].concat(p.shape.slice(1));
-  var pppShape = [pp.shape[0] / 2, 2].concat(pp.shape.slice(1));
-  assertEqArray(pp.shape, ppShape);
-  assertEq(pp.toString(), "<1,2>,<3,4>,<5,6>,<7,8>");
-  assertEqArray(ppp.shape, pppShape);
-  assertEq(ppp.toString(), "<<1,2>,<3,4>>,<<5,6>,<7,8>>");
-}
-
-if (getBuildConfiguration().parallelJS) testPartition();
diff --git a/js/src/jit-test/tests/parallel/partition-throws.js b/js/src/jit-test/tests/parallel/partition-throws.js
deleted file mode 100644
index 7126b3a39002..000000000000
--- a/js/src/jit-test/tests/parallel/partition-throws.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "asserts.js");
-
-function testPartitionDivisible() {
-  var p = new ParallelArray([1,2,3,4]);
-  var pp;
-  assertThrowsInstanceOf(function () { pp = p.partition(3); }, Error);
-  assertThrowsInstanceOf(function () { pp = p.partition(.34); }, Error);
-}
-
-if (getBuildConfiguration().parallelJS) testPartitionDivisible();
diff --git a/js/src/jit-test/tests/parallel/reduce-higher-dim.js b/js/src/jit-test/tests/parallel/reduce-higher-dim.js
deleted file mode 100644
index efe8d60fbab2..000000000000
--- a/js/src/jit-test/tests/parallel/reduce-higher-dim.js
+++ /dev/null
@@ -1,14 +0,0 @@
-
-function testReduce() {
-  // Test reduce on higher dimensional
-  // XXX Can we test this better?
-  var shape = [2];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return i+1; });
-    var r = p.reduce(function (a, b) { return a; });
-    assertEq(r.shape.length, i + 1);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testReduce();
diff --git a/js/src/jit-test/tests/parallel/reduce-throws.js b/js/src/jit-test/tests/parallel/reduce-throws.js
deleted file mode 100644
index bc2b45546281..000000000000
--- a/js/src/jit-test/tests/parallel/reduce-throws.js
+++ /dev/null
@@ -1,17 +0,0 @@
-load(libdir + "asserts.js");
-
-function testReduceThrows() {
-  // Throw on empty
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([]);
-    p.reduce(function (v, p) { return v*p; });
-  }, Error);
-  // Throw on not function
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([1]);
-    p.reduce(42);
-  }, TypeError);
-}
-
-// FIXME(bug 844886) sanity check argument types
-// if (getBuildConfiguration().parallelJS) testReduceThrows();
diff --git a/js/src/jit-test/tests/parallel/scan-3.js b/js/src/jit-test/tests/parallel/scan-3.js
deleted file mode 100644
index 9d2f812c97f4..000000000000
--- a/js/src/jit-test/tests/parallel/scan-3.js
+++ /dev/null
@@ -1,17 +0,0 @@
-function testScan() {
-  // Test reduce on higher dimensional
-  // XXX Can we test this better?
-  function f(a, b) { return a; }
-  var shape = [2];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return i+1; });
-    var r = p.reduce(f);
-    var s = p.scan(f)
-    for (var j = 0; j < s.length; j++)
-      assertEq(s.get(j).shape.length, i + 1);
-    assertEq(r.shape.length, i + 1);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testScan();
diff --git a/js/src/jit-test/tests/parallel/scan-throws.js b/js/src/jit-test/tests/parallel/scan-throws.js
deleted file mode 100644
index 4cdcceb095b5..000000000000
--- a/js/src/jit-test/tests/parallel/scan-throws.js
+++ /dev/null
@@ -1,18 +0,0 @@
-load(libdir + "asserts.js");
-
-function testScanThrows() {
-  // Throw on empty
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([]);
-    p.scan(function (v, p) { return v*p; });
-  }, Error);
-
-  // Throw on not function
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([1]);
-    p.scan(42);
-  }, TypeError);
-}
-
-// FIXME(bug 844886) sanity check argument types
-// if (getBuildConfiguration().parallelJS) testScanThrows();
diff --git a/js/src/jit-test/tests/parallel/scatter-1.js b/js/src/jit-test/tests/parallel/scatter-1.js
deleted file mode 100644
index 69e963982a06..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-1.js
+++ /dev/null
@@ -1,8 +0,0 @@
-
-function testScatter() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, 10);
-  assertEq(r.length, 10);
-}
-
-if (getBuildConfiguration().parallelJS) testScatter();
diff --git a/js/src/jit-test/tests/parallel/scatter-10.js b/js/src/jit-test/tests/parallel/scatter-10.js
deleted file mode 100644
index 01f3bacbec9c..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-10.js
+++ /dev/null
@@ -1,21 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is just a simple reverse permutation of the input:
-// [A, B, ..., Y, Z] ==> [Z, Y, ..., B, A]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var revidx = build(len, id).reverse();
-  var p2 = new ParallelArray(revidx.map(add1));
-  testScatter(
-    m => p.scatter(revidx, 0, undefined, len, m),
-    r => assertEqParallelArray(r, p2));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-11.js b/js/src/jit-test/tests/parallel/scatter-11.js
deleted file mode 100644
index e7b443bdd735..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-11.js
+++ /dev/null
@@ -1,21 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is a reverse permutation that has a gap at the end.
-// [A, B, ..., Y, Z] ==> [Z, Y, ..., B, A, 0]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var revidx = build(len, id).reverse();
-  var p2 = new ParallelArray(revidx.map(add1).concat([0]));
-  testScatter(
-    m => p.scatter(revidx, 0, undefined, len+1, m),
-    r => assertEqParallelArray(r, p2));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-12.js b/js/src/jit-test/tests/parallel/scatter-12.js
deleted file mode 100644
index 1cf9bd90e7d4..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-12.js
+++ /dev/null
@@ -1,22 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is a reverse permutation that has a gap at the start and at the end.
-// [A, B, ..., Y, Z] ==> [0, Z, Y, ..., B, A, 0]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var revidx = build(len, add1).reverse();
-  var p2 = new ParallelArray([0].concat(revidx).concat([0]));
-
-  testScatter(
-    m => p.scatter(revidx, 0, undefined, len+2, m),
-    r => assertEqParallelArray(r, p2));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-13.js b/js/src/jit-test/tests/parallel/scatter-13.js
deleted file mode 100644
index 20d0c19c2d9d..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-13.js
+++ /dev/null
@@ -1,24 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is a reverse permutation of the input with collisions at front and end
-// [A, B, C, D, ..., W, X, Y, Z] ==> [Z+Y, X, W, ..., D, C, B+A]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function add3(x) { return x+3; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var idx = [0,0].concat(build(len-4, add1)).concat([len-3,len-3]);
-  var revidx = idx.reverse();
-  var p2 = [3].concat(build(len-4, add3)).concat([2*len-1]);
-  var expect = new ParallelArray(p2.reverse());
-  testScatter(
-    m => p.scatter(revidx, 0, function (x,y) { return x+y; }, len-2, m),
-    r => assertEqParallelArray(r, expect));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-2.js b/js/src/jit-test/tests/parallel/scatter-2.js
deleted file mode 100644
index 07cfb5006a04..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-2.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterIdentity() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,2,3,4]);
-  assertEqParallelArray(p, r);
-}
-
-if (getBuildConfiguration().parallelJS) testScatterIdentity();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-3.js b/js/src/jit-test/tests/parallel/scatter-3.js
deleted file mode 100644
index 06a4a22ce8de..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatter3() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([1,0,3,2,4]);
-  var p2 = new ParallelArray([2,1,4,3,5]);
-  assertStructuralEq(r, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testScatter3();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-4.js b/js/src/jit-test/tests/parallel/scatter-4.js
deleted file mode 100644
index 6180397b92a1..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-4.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterDefault() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,2,4], 9);
-  assertEqParallelArray(r, new ParallelArray([1,9,2,9,3]));
-}
-
-if (getBuildConfiguration().parallelJS) testScatterDefault();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-5.js b/js/src/jit-test/tests/parallel/scatter-5.js
deleted file mode 100644
index ccb88684f45b..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-5.js
+++ /dev/null
@@ -1,9 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterConflict() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; });
-  assertEqParallelArray(r, new ParallelArray([4,2,9,4,5]));
-}
-
-if (getBuildConfiguration().parallelJS) testScatterConflict();
diff --git a/js/src/jit-test/tests/parallel/scatter-6.js b/js/src/jit-test/tests/parallel/scatter-6.js
deleted file mode 100644
index 35996d791f36..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-6.js
+++ /dev/null
@@ -1,13 +0,0 @@
-
-function testScatter() {
-  // Test scatter on higher dimension
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function(k) { return k; });
-    var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, 10);
-    assertEq(r.length, 10);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testScatter();
diff --git a/js/src/jit-test/tests/parallel/scatter-7.js b/js/src/jit-test/tests/parallel/scatter-7.js
deleted file mode 100644
index f266fe2e2d24..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-7.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterIdentity() {
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(2);
-    var p = new ParallelArray(shape, function(k) { return k; });
-    var r = p.scatter([0,1,2,3,4]);
-    var p2 = new ParallelArray([p.get(0), p.get(1), p.get(2), p.get(3), p.get(4)]);
-    assertEqParallelArray(p2, r);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testScatterIdentity();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-8.js b/js/src/jit-test/tests/parallel/scatter-8.js
deleted file mode 100644
index d735df6af2c3..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-8.js
+++ /dev/null
@@ -1,16 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatter8() {
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(2);
-    var p = new ParallelArray(shape, function(k) { return k; });
-    var r = p.scatter([1,0,3,2,4]);
-    var p2 = new ParallelArray([p.get(1), p.get(0), p.get(3), p.get(2), p.get(4)]);
-    assertEqParallelArray(p2, r);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testScatter8();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-9.js b/js/src/jit-test/tests/parallel/scatter-9.js
deleted file mode 100644
index 22be34e50056..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-9.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatter9() {
-  // Ignore the rest of the scatter vector if longer than source
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([1,0,3,2,4,1,2,3]);
-  var p2 = new ParallelArray([2,1,4,3,5]);
-  assertEqParallelArray(r, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testScatter9();
diff --git a/js/src/jit-test/tests/parallel/scatter-regression-1.js b/js/src/jit-test/tests/parallel/scatter-regression-1.js
deleted file mode 100644
index 4a6fc5173a20..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-regression-1.js
+++ /dev/null
@@ -1,18 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// The bug this is testing for:
-// the input p and the scatter vector have length 4
-// and the output p2 has length 3.  Even though p2
-// is shorter than the input lengths, we still need
-// to scan the entirety of the scatter vector, because
-// it may hold valid targets at distant indices.
-function test() {
-  var p = new ParallelArray([2,3,5,17]);
-  var r = p.scatter([0,0,2,1], 9, function (x,y) { return x * y; }, 3);
-  var p2 = new ParallelArray([6,17,5]);
-  assertEqParallelArray(r, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-throws.js b/js/src/jit-test/tests/parallel/scatter-throws.js
deleted file mode 100644
index 61c37b9a0f24..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-throws.js
+++ /dev/null
@@ -1,31 +0,0 @@
-load(libdir + "asserts.js");
-
-function testScatterThrows() {
-  var p = new ParallelArray([1,2,3,4,5]);
-
-  // Throw on conflict with no resolution function
-  assertThrowsInstanceOf(function () {
-    var r = p.scatter([0,1,0,3,4]);
-  }, Error);
-  // Throw on out of bounds
-  assertThrowsInstanceOf(function () {
-    var r = p.scatter([0,1,0,3,11]);
-  }, Error);
-
-  assertThrowsInstanceOf(function () {
-    p.scatter([-1,1,0,3,4], 9, function (a,b) { return a+b; }, 10);
-  }, TypeError);
-  assertThrowsInstanceOf(function () {
-    p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, -1);
-  }, RangeError);
-  assertThrowsInstanceOf(function () {
-    p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, 0xffffffff + 1);
-  }, RangeError);
-  assertThrowsInstanceOf(function () {
-    p.scatter({ length: 0xffffffff + 1 }, 9, function (a,b) { return a+b; }, 10);
-  }, RangeError);
-
-}
-
-// FIXME(bug 844886) sanity check argument types
-// if (getBuildConfiguration().parallelJS) testScatterThrows();
diff --git a/js/src/jit-test/tests/parallel/shape-1.js b/js/src/jit-test/tests/parallel/shape-1.js
deleted file mode 100644
index bb455da812b1..000000000000
--- a/js/src/jit-test/tests/parallel/shape-1.js
+++ /dev/null
@@ -1,8 +0,0 @@
-function testShape() {
-  var a = [1,2,3];
-  var p = new ParallelArray(a);
-  assertEq(p.shape.length, 1);
-  assertEq(p.shape[0], a.length);
-}
-
-if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/shape-2.js b/js/src/jit-test/tests/parallel/shape-2.js
deleted file mode 100644
index 8ab7efada68b..000000000000
--- a/js/src/jit-test/tests/parallel/shape-2.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testShape() {
-  // Test higher dimension shape up to 8D
-  var shape = [];
-  for (var i = 0; i < 8; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return 0; });
-    // Test shape identity and shape
-    assertEqArray(p.shape, shape);
-    assertEq(p.shape !== shape, true);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/shape-3.js b/js/src/jit-test/tests/parallel/shape-3.js
deleted file mode 100644
index e8af4033b67d..000000000000
--- a/js/src/jit-test/tests/parallel/shape-3.js
+++ /dev/null
@@ -1,16 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testInfer() {
-  // Test that shapes are inferred
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2,3]);
-  var p = new ParallelArray([p0, p1]);
-  assertEqArray(p.shape, [2,2]);
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2]);
-  var p = new ParallelArray([p0, p1]);
-  assertEqArray(p.shape, [2]);
-}
-
-// FIXME(bug 844991) logical shape not implemented
-// if (parallelEnabled) testInfer();
diff --git a/js/src/jit-test/tests/parallel/shape-4.js b/js/src/jit-test/tests/parallel/shape-4.js
deleted file mode 100644
index ddd47bb9c12f..000000000000
--- a/js/src/jit-test/tests/parallel/shape-4.js
+++ /dev/null
@@ -1,13 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testShape() {
-  // Test shape immutability.
-  var p = new ParallelArray([1,2,3,4]);
-  p.shape[0] = 0;
-  p.shape[1] = 42;
-  assertEq(p[0], 1);
-  assertEqArray(p.shape, [4]);
-}
-
-// FIXME(bug 844988) immutability not enforced
-// if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/shape-5.js b/js/src/jit-test/tests/parallel/shape-5.js
deleted file mode 100644
index ddd47bb9c12f..000000000000
--- a/js/src/jit-test/tests/parallel/shape-5.js
+++ /dev/null
@@ -1,13 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testShape() {
-  // Test shape immutability.
-  var p = new ParallelArray([1,2,3,4]);
-  p.shape[0] = 0;
-  p.shape[1] = 42;
-  assertEq(p[0], 1);
-  assertEqArray(p.shape, [4]);
-}
-
-// FIXME(bug 844988) immutability not enforced
-// if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/stack-overflow.js b/js/src/jit-test/tests/parallel/stack-overflow.js
index 8993ff5703d9..c62f1de071c7 100644
--- a/js/src/jit-test/tests/parallel/stack-overflow.js
+++ b/js/src/jit-test/tests/parallel/stack-overflow.js
@@ -9,9 +9,9 @@ function kernel(n) {
 }
 
 function testMap() {
-  var p = new ParallelArray(range(0, 2048));
+  var p = range(0, 2048);
   assertParallelExecWillBail(
-    m => p.map(kernel, m));
+    m => p.mapPar(kernel, m));
 }
 
 if (getBuildConfiguration().parallelJS)
diff --git a/js/src/jit-test/tests/parallel/toString-1.js b/js/src/jit-test/tests/parallel/toString-1.js
deleted file mode 100644
index 96514373e399..000000000000
--- a/js/src/jit-test/tests/parallel/toString-1.js
+++ /dev/null
@@ -1,6 +0,0 @@
-function testToString() {
-  var p = new ParallelArray();
-  assertEq(p.toString(), "");
-}
-
-if (getBuildConfiguration().parallelJS) testToString();
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index dc8b1231cd60..e12f63ccfe7c 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -7868,19 +7868,6 @@ GetTemplateObjectForNative(JSContext *cx, HandleScript script, jsbytecode *pc,
         return true;
     }
 
-    if (native == intrinsic_NewParallelArray || native == ParallelArrayObject::construct) {
-        res.set(ParallelArrayObject::newInstance(cx, TenuredObject));
-        if (!res)
-            return false;
-
-        types::TypeObject *type =
-            types::TypeScript::InitObject(cx, script, pc, JSProto_ParallelArray);
-        if (!type)
-            return false;
-        res->setType(type);
-        return true;
-    }
-
     return true;
 }
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 7cbe48d16495..b9c2d6bd1525 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2937,50 +2937,6 @@ CodeGenerator::generateBody()
     return true;
 }
 
-// Out-of-line object allocation for LNewParallelArray.
-class OutOfLineNewParallelArray : public OutOfLineCodeBase<CodeGenerator>
-{
-    LNewParallelArray *lir_;
-
-  public:
-    OutOfLineNewParallelArray(LNewParallelArray *lir)
-      : lir_(lir)
-    { }
-
-    bool accept(CodeGenerator *codegen) {
-        return codegen->visitOutOfLineNewParallelArray(this);
-    }
-
-    LNewParallelArray *lir() const {
-        return lir_;
-    }
-};
-
-typedef JSObject *(*NewInitParallelArrayFn)(JSContext *, HandleObject);
-static const VMFunction NewInitParallelArrayInfo =
-    FunctionInfo<NewInitParallelArrayFn>(NewInitParallelArray);
-
-bool
-CodeGenerator::visitNewParallelArrayVMCall(LNewParallelArray *lir)
-{
-    JS_ASSERT(gen->info().executionMode() == SequentialExecution);
-
-    Register objReg = ToRegister(lir->output());
-
-    JS_ASSERT(!lir->isCall());
-    saveLive(lir);
-
-    pushArg(ImmGCPtr(lir->mir()->templateObject()));
-    if (!callVM(NewInitParallelArrayInfo, lir))
-        return false;
-
-    if (ReturnReg != objReg)
-        masm.movePtr(ReturnReg, objReg);
-
-    restoreLive(lir);
-    return true;
-}
-
 // Out-of-line object allocation for LNewArray.
 class OutOfLineNewArray : public OutOfLineCodeBase<CodeGenerator>
 {
@@ -3104,32 +3060,6 @@ bool CodeGenerator::visitHypot(LHypot *lir)
     return true;
 }
 
-bool
-CodeGenerator::visitNewParallelArray(LNewParallelArray *lir)
-{
-    Register objReg = ToRegister(lir->output());
-    JSObject *templateObject = lir->mir()->templateObject();
-
-    OutOfLineNewParallelArray *ool = new(alloc()) OutOfLineNewParallelArray(lir);
-    if (!addOutOfLineCode(ool))
-        return false;
-
-    masm.newGCThing(objReg, templateObject, ool->entry(), gc::DefaultHeap);
-    masm.initGCThing(objReg, templateObject);
-
-    masm.bind(ool->rejoin());
-    return true;
-}
-
-bool
-CodeGenerator::visitOutOfLineNewParallelArray(OutOfLineNewParallelArray *ool)
-{
-    if (!visitNewParallelArrayVMCall(ool->lir()))
-        return false;
-    masm.jump(ool->rejoin());
-    return true;
-}
-
 bool
 CodeGenerator::visitNewArray(LNewArray *lir)
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index e522f27da234..7f264c981c8c 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -25,7 +25,6 @@
 namespace js {
 namespace jit {
 
-class OutOfLineNewParallelArray;
 class OutOfLineTestObject;
 class OutOfLineNewArray;
 class OutOfLineNewObject;
@@ -127,9 +126,6 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitDoubleToInt32(LDoubleToInt32 *lir);
     bool visitFloat32ToInt32(LFloat32ToInt32 *lir);
     bool visitNewSlots(LNewSlots *lir);
-    bool visitNewParallelArrayVMCall(LNewParallelArray *lir);
-    bool visitNewParallelArray(LNewParallelArray *lir);
-    bool visitOutOfLineNewParallelArray(OutOfLineNewParallelArray *ool);
     bool visitNewArrayCallVM(LNewArray *lir);
     bool visitNewArray(LNewArray *lir);
     bool visitOutOfLineNewArray(OutOfLineNewArray *ool);
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 2404e147d2df..b3094b74e461 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -645,16 +645,6 @@ class IonBuilder : public MIRGenerator
     InliningStatus inlineUnsafeSetReservedSlot(CallInfo &callInfo);
     InliningStatus inlineUnsafeGetReservedSlot(CallInfo &callInfo);
 
-    // Parallel intrinsics.
-    InliningStatus inlineNewParallelArray(CallInfo &callInfo);
-    InliningStatus inlineParallelArray(CallInfo &callInfo);
-    InliningStatus inlineParallelArrayTail(CallInfo &callInfo,
-                                           JSFunction *target,
-                                           MDefinition *ctor,
-                                           types::TemporaryTypeSet *ctorTypes,
-                                           uint32_t discards,
-                                           Native native);
-
     // Utility intrinsics.
     InliningStatus inlineIsCallable(CallInfo &callInfo);
     InliningStatus inlineHaveSameClass(CallInfo &callInfo);
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 13c803502d6c..8f94028624a1 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -302,16 +302,6 @@ class LNewSlots : public LCallInstructionHelper<1, 0, 3>
     }
 };
 
-class LNewParallelArray : public LInstructionHelper<1, 0, 0>
-{
-  public:
-    LIR_HEADER(NewParallelArray);
-
-    MNewParallelArray *mir() const {
-        return mir_->toNewParallelArray();
-    }
-};
-
 class LNewArray : public LInstructionHelper<1, 0, 0>
 {
   public:
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 44d9db360964..9e731b593006 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -22,7 +22,6 @@
     _(TableSwitch)                  \
     _(TableSwitchV)                 \
     _(Goto)                         \
-    _(NewParallelArray)             \
     _(NewArray)                     \
     _(NewObject)                    \
     _(NewSlots)                     \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 92ceb8941332..54b3a02c0a76 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -160,13 +160,6 @@ LIRGenerator::visitNewSlots(MNewSlots *ins)
     return defineReturn(lir, ins);
 }
 
-bool
-LIRGenerator::visitNewParallelArray(MNewParallelArray *ins)
-{
-    LNewParallelArray *lir = new(alloc()) LNewParallelArray();
-    return define(lir, ins) && assignSafepoint(lir, ins);
-}
-
 bool
 LIRGenerator::visitNewArray(MNewArray *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index 8302b9f16d68..9e772343fd30 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -81,7 +81,6 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitGoto(MGoto *ins);
     bool visitTableSwitch(MTableSwitch *tableswitch);
     bool visitNewSlots(MNewSlots *ins);
-    bool visitNewParallelArray(MNewParallelArray *ins);
     bool visitNewArray(MNewArray *ins);
     bool visitNewObject(MNewObject *ins);
     bool visitNewDeclEnvObject(MNewDeclEnvObject *ins);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 6292fc1ab510..4b010bb50650 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -6,7 +6,6 @@
 
 #include "jsmath.h"
 
-#include "builtin/ParallelArray.h"
 #include "builtin/TestingFunctions.h"
 #include "jit/BaselineInspector.h"
 #include "jit/IonBuilder.h"
@@ -137,10 +136,6 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSNative native)
     // Parallel intrinsics.
     if (native == intrinsic_ShouldForceSequential)
         return inlineForceSequentialOrInParallelSection(callInfo);
-    if (native == intrinsic_NewParallelArray)
-        return inlineNewParallelArray(callInfo);
-    if (native == ParallelArrayObject::construct)
-        return inlineParallelArray(callInfo);
 
     // Utility intrinsics.
     if (native == intrinsic_IsCallable)
@@ -1244,153 +1239,6 @@ IonBuilder::inlineForceSequentialOrInParallelSection(CallInfo &callInfo)
     MOZ_ASSUME_UNREACHABLE("Invalid execution mode");
 }
 
-IonBuilder::InliningStatus
-IonBuilder::inlineNewParallelArray(CallInfo &callInfo)
-{
-    // Rewrites a call like
-    //
-    //    NewParallelArray(ParallelArrayView, arg0, ..., argN)
-    //
-    // to
-    //
-    //    x = MNewParallelArray()
-    //    ParallelArrayView(x, arg0, ..., argN)
-
-    uint32_t argc = callInfo.argc();
-    if (argc < 1 || callInfo.constructing())
-        return InliningStatus_NotInlined;
-
-    types::TemporaryTypeSet *ctorTypes = callInfo.getArg(0)->resultTypeSet();
-    JSObject *targetObj = ctorTypes ? ctorTypes->getSingleton() : nullptr;
-    JSFunction *target = nullptr;
-    if (targetObj && targetObj->is<JSFunction>())
-        target = &targetObj->as<JSFunction>();
-    if (target && target->isInterpreted() && target->nonLazyScript()->shouldCloneAtCallsite()) {
-        if (JSFunction *clone = ExistingCloneFunctionAtCallsite(compartment->callsiteClones(), target, script(), pc))
-            target = clone;
-    }
-    MDefinition *ctor = makeCallsiteClone(
-        target,
-        callInfo.getArg(0)->toPassArg()->getArgument());
-
-    // Discard the function.
-    return inlineParallelArrayTail(callInfo, target, ctor,
-                                   target ? nullptr : ctorTypes, 1,
-                                   intrinsic_NewParallelArray);
-}
-
-IonBuilder::InliningStatus
-IonBuilder::inlineParallelArray(CallInfo &callInfo)
-{
-    if (!callInfo.constructing())
-        return InliningStatus_NotInlined;
-
-    uint32_t argc = callInfo.argc();
-    JSFunction *target = ParallelArrayObject::maybeGetConstructor(&script()->global(), argc);
-    if (!target)
-        return InliningStatus_NotInlined;
-
-    JS_ASSERT(target->nonLazyScript()->shouldCloneAtCallsite());
-    if (JSFunction *clone = ExistingCloneFunctionAtCallsite(compartment->callsiteClones(), target, script(), pc))
-        target = clone;
-
-    MConstant *ctor = MConstant::New(alloc(), ObjectValue(*target));
-    current->add(ctor);
-
-    return inlineParallelArrayTail(callInfo, target, ctor, nullptr, 0,
-                                   ParallelArrayObject::construct);
-}
-
-IonBuilder::InliningStatus
-IonBuilder::inlineParallelArrayTail(CallInfo &callInfo,
-                                    JSFunction *target,
-                                    MDefinition *ctor,
-                                    types::TemporaryTypeSet *ctorTypes,
-                                    uint32_t discards,
-                                    Native native)
-{
-    // Rewrites either NewParallelArray(...) or new ParallelArray(...) from a
-    // call to a native ctor into a call to the relevant function in the
-    // self-hosted code.
-
-    uint32_t argc = callInfo.argc() - discards;
-
-    // Create the new parallel array object.  Parallel arrays have specially
-    // constructed type objects, so we can only perform the inlining if we
-    // already have one of these type objects.
-    types::TemporaryTypeSet *returnTypes = getInlineReturnTypeSet();
-    if (returnTypes->getKnownTypeTag() != JSVAL_TYPE_OBJECT)
-        return InliningStatus_NotInlined;
-    if (returnTypes->unknownObject() || returnTypes->getObjectCount() != 1)
-        return InliningStatus_NotInlined;
-    types::TypeObject *typeObject = returnTypes->getTypeObject(0);
-    if (!typeObject || typeObject->clasp != &ParallelArrayObject::class_)
-        return InliningStatus_NotInlined;
-
-    JSObject *templateObject = inspector->getTemplateObjectForNative(pc, native);
-    if (!templateObject || templateObject->type() != typeObject)
-        return InliningStatus_NotInlined;
-
-    // Create the call and add in the non-this arguments.
-    uint32_t targetArgs = argc;
-    if (target && !target->isNative())
-        targetArgs = Max<uint32_t>(target->nargs, argc);
-
-    MCall *call = MCall::New(alloc(), target, targetArgs + 1, argc, false);
-    if (!call)
-        return InliningStatus_Error;
-
-    callInfo.unwrapArgs();
-
-    // Explicitly pad any missing arguments with |undefined|.
-    // This permits skipping the argumentsRectifier.
-    for (uint32_t i = targetArgs; i > argc; i--) {
-        JS_ASSERT_IF(target, !target->isNative());
-        MConstant *undef = MConstant::New(alloc(), UndefinedValue());
-        current->add(undef);
-        MPassArg *pass = MPassArg::New(alloc(), undef);
-        current->add(pass);
-        call->addArg(i, pass);
-    }
-
-    MPassArg *oldThis = MPassArg::New(alloc(), callInfo.thisArg());
-    current->add(oldThis);
-
-    // Add explicit arguments.
-    // Skip addArg(0) because it is reserved for this
-    for (uint32_t i = 0; i < argc; i++) {
-        MDefinition *arg = callInfo.getArg(i + discards);
-        MPassArg *passArg = MPassArg::New(alloc(), arg);
-        current->add(passArg);
-        call->addArg(i + 1, passArg);
-    }
-
-    // Place an MPrepareCall before the first passed argument, before we
-    // potentially perform rearrangement.
-    MPrepareCall *start = MPrepareCall::New(alloc());
-    oldThis->block()->insertBefore(oldThis, start);
-    call->initPrepareCall(start);
-
-    // Create the MIR to allocate the new parallel array.  Take the type
-    // object is taken from the prediction set.
-    MNewParallelArray *newObject = MNewParallelArray::New(alloc(), templateObject);
-    current->add(newObject);
-    MPassArg *newThis = MPassArg::New(alloc(), newObject);
-    current->add(newThis);
-    call->addArg(0, newThis);
-
-    // Set the new callee.
-    call->initFunction(ctor);
-
-    current->add(call);
-    current->push(newObject);
-
-    if (!resumeAfter(call))
-        return InliningStatus_Error;
-
-    return InliningStatus_Inlined;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineNewDenseArray(CallInfo &callInfo)
 {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 23713460447c..97207eed77b7 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -1363,32 +1363,6 @@ class MThrow
     }
 };
 
-class MNewParallelArray : public MNullaryInstruction
-{
-    CompilerRootObject templateObject_;
-
-    MNewParallelArray(JSObject *templateObject)
-      : templateObject_(templateObject)
-    {
-        setResultType(MIRType_Object);
-    }
-
-  public:
-    INSTRUCTION_HEADER(NewParallelArray);
-
-    static MNewParallelArray *New(TempAllocator &alloc, JSObject *templateObject) {
-        return new(alloc) MNewParallelArray(templateObject);
-    }
-
-    AliasSet getAliasSet() const {
-        return AliasSet::None();
-    }
-
-    JSObject *templateObject() const {
-        return templateObject_;
-    }
-};
-
 // Fabricate a type set containing only the type of the specified object.
 types::TemporaryTypeSet *
 MakeSingletonTypeSet(JSObject *obj);
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 12cee893cefa..e2d348dc6a28 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -87,7 +87,6 @@ namespace jit {
     _(TruncateToInt32)                                                      \
     _(ToString)                                                             \
     _(NewSlots)                                                             \
-    _(NewParallelArray)                                                     \
     _(NewArray)                                                             \
     _(NewObject)                                                            \
     _(NewDeclEnvObject)                                                     \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index 446e0f159f6c..40494356146c 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -184,7 +184,6 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     CUSTOM_OP(NewArray)
     CUSTOM_OP(NewObject)
     CUSTOM_OP(NewCallObject)
-    CUSTOM_OP(NewParallelArray)
     UNSAFE_OP(NewDerivedTypedObject)
     UNSAFE_OP(InitElem)
     UNSAFE_OP(InitElemGetterSetter)
@@ -517,12 +516,6 @@ ParallelSafetyVisitor::visitCreateThisWithTemplate(MCreateThisWithTemplate *ins)
     return replaceWithNewPar(ins, ins->templateObject());
 }
 
-bool
-ParallelSafetyVisitor::visitNewParallelArray(MNewParallelArray *ins)
-{
-    return replaceWithNewPar(ins, ins->templateObject());
-}
-
 bool
 ParallelSafetyVisitor::visitNewCallObject(MNewCallObject *ins)
 {
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 7e76e8857473..8c8ad1c9c753 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -6,7 +6,6 @@
 
 #include "jit/VMFunctions.h"
 
-#include "builtin/ParallelArray.h"
 #include "builtin/TypedObject.h"
 #include "frontend/BytecodeCompiler.h"
 #include "jit/BaselineIC.h"
@@ -277,21 +276,6 @@ IteratorMore(JSContext *cx, HandleObject obj, bool *res)
     return true;
 }
 
-JSObject *
-NewInitParallelArray(JSContext *cx, HandleObject templateObject)
-{
-    JS_ASSERT(templateObject->getClass() == &ParallelArrayObject::class_);
-    JS_ASSERT(!templateObject->hasSingletonType());
-
-    RootedObject obj(cx, ParallelArrayObject::newInstance(cx, TenuredObject));
-    if (!obj)
-        return nullptr;
-
-    obj->setType(templateObject->type());
-
-    return obj;
-}
-
 JSObject*
 NewInitArray(JSContext *cx, uint32_t count, types::TypeObject *typeArg)
 {
diff --git a/js/src/js.msg b/js/src/js.msg
index 5a8344163bab..072f28a8a3e6 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -354,10 +354,10 @@ MSG_DEF(JSMSG_NONDEFAULT_FORMAL_AFTER_DEFAULT, 300, 0, JSEXN_SYNTAXERR, "paramet
 MSG_DEF(JSMSG_YIELD_IN_DEFAULT,       301, 0, JSEXN_SYNTAXERR, "yield in default expression")
 MSG_DEF(JSMSG_INTRINSIC_NOT_DEFINED,  302, 1, JSEXN_REFERENCEERR, "no intrinsic function {0}")
 MSG_DEF(JSMSG_ALREADY_HAS_PRAGMA, 303, 2, JSEXN_ERR,      "{0} is being assigned a {1}, but already has one")
-MSG_DEF(JSMSG_PAR_ARRAY_BAD_ARG,      304, 1, JSEXN_RANGEERR, "invalid ParallelArray{0} argument")
-MSG_DEF(JSMSG_PAR_ARRAY_BAD_PARTITION, 305, 0, JSEXN_ERR, "argument must be divisible by outermost dimension")
-MSG_DEF(JSMSG_PAR_ARRAY_REDUCE_EMPTY, 306, 0, JSEXN_ERR, "cannot reduce ParallelArray object whose outermost dimension is empty")
-MSG_DEF(JSMSG_PAR_ARRAY_ALREADY_FLAT, 307, 0, JSEXN_ERR, "cannot flatten 1-dimensional ParallelArray object")
+MSG_DEF(JSMSG_PAR_ARRAY_BAD_ARG,      304, 0, JSEXN_RANGEERR, "invalid parallel method argument")
+MSG_DEF(JSMSG_UNUSED305,              305, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED306,              306, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED307,              307, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_PAR_ARRAY_SCATTER_CONFLICT, 308, 0, JSEXN_ERR, "no conflict resolution function provided")
 MSG_DEF(JSMSG_PAR_ARRAY_SCATTER_BOUNDS, 309, 0, JSEXN_ERR, "index in scatter vector out of bounds")
 MSG_DEF(JSMSG_CANT_REPORT_NC_AS_NE,   310, 0, JSEXN_TYPEERR, "proxy can't report a non-configurable own property as non-existent")
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 38996d6f9ae1..882c65b08b8e 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -52,7 +52,6 @@
 #include "builtin/Eval.h"
 #include "builtin/Intl.h"
 #include "builtin/MapObject.h"
-#include "builtin/ParallelArray.h"
 #include "builtin/RegExp.h"
 #include "builtin/TypedObject.h"
 #include "frontend/BytecodeCompiler.h"
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index c4e07abd3271..0166b368d659 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -15,7 +15,6 @@
 
 #include "jsanalyze.h"
 
-#include "builtin/ParallelArray.h"
 #include "jit/ExecutionModeInlines.h"
 #include "vm/ArrayObject.h"
 #include "vm/BooleanObject.h"
@@ -354,9 +353,6 @@ GetClassForProtoKey(JSProtoKey key)
       case JSProto_DataView:
         return &DataViewObject::class_;
 
-      case JSProto_ParallelArray:
-        return &ParallelArrayObject::class_;
-
       default:
         MOZ_ASSUME_UNREACHABLE("Bad proto key");
     }
diff --git a/js/src/jsprototypes.h b/js/src/jsprototypes.h
index bc4a767033de..447e080ca5fa 100644
--- a/js/src/jsprototypes.h
+++ b/js/src/jsprototypes.h
@@ -91,10 +91,9 @@
     real(Map,                   33,     js_InitMapClass,           OCLASP(Map)) \
     real(Set,                   34,     js_InitSetClass,           OCLASP(Set)) \
     real(DataView,              35,     js_InitTypedArrayClasses,  OCLASP(DataView)) \
-IF_PJS(real,imaginary)  (ParallelArray,         36,     js_InitParallelArrayClass, OCLASP(ParallelArray)) \
-IF_INTL(real,imaginary) (Intl,                  37,     js_InitIntlClass,          CLASP(Intl)) \
-IF_BDATA(real,imaginary)(TypedObject,           38,     js_InitTypedObjectModuleObject,   OCLASP(TypedObjectModule)) \
-    imaginary(GeneratorFunction,     39,     js_InitIteratorClasses, dummy) \
+IF_INTL(real,imaginary) (Intl,                  36,     js_InitIntlClass,          CLASP(Intl)) \
+IF_BDATA(real,imaginary)(TypedObject,           37,     js_InitTypedObjectModuleObject,   OCLASP(TypedObjectModule)) \
+    imaginary(GeneratorFunction,     38,     js_InitIteratorClasses, dummy) \
 
 #define JS_FOR_EACH_PROTOTYPE(macro) JS_FOR_PROTOTYPES(macro,macro)
 
diff --git a/js/src/moz.build b/js/src/moz.build
index 31769c7439b5..73d1083e9a30 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -96,7 +96,6 @@ UNIFIED_SOURCES += [
     'builtin/Intl.cpp',
     'builtin/MapObject.cpp',
     'builtin/Object.cpp',
-    'builtin/ParallelArray.cpp',
     'builtin/Profilers.cpp',
     'builtin/TestingFunctions.cpp',
     'builtin/TypedObject.cpp',
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 1f2e41df78fe..c60745b0cd1d 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -191,7 +191,7 @@ namespace js {
 // of operation.
 enum ForkJoinMode {
     // WARNING: If you change this enum, you MUST update
-    // ForkJoinMode() in ParallelArray.js
+    // ForkJoinMode() in Utilities.js
 
     // The "normal" behavior: attempt parallel, fallback to
     // sequential.  If compilation is ongoing in a helper thread, then
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 6ec8721d960a..51948545ca95 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -516,9 +516,6 @@ GlobalObject::initStandardClasses(JSContext *cx, Handle<GlobalObject*> global)
            GlobalObject::initSetIteratorProto(cx, global) &&
 #if EXPOSE_INTL_API
            js_InitIntlClass(cx, global) &&
-#endif
-#if ENABLE_PARALLEL_JS
-           js_InitParallelArrayClass(cx, global) &&
 #endif
            true;
 }
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 62f86a4795d6..55335eacfa05 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -12,7 +12,6 @@
 #include "selfhosted.out.h"
 
 #include "builtin/Intl.h"
-#include "builtin/ParallelArray.h"
 #include "builtin/TypedObject.h"
 #include "gc/Marking.h"
 #include "vm/ForkJoin.h"
@@ -311,27 +310,6 @@ intrinsic_ForkJoinSlices(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
-/*
- * NewParallelArray(init, ...args): Creates a new parallel array using
- * an initialization function |init|. All subsequent arguments are
- * passed to |init|. The new instance will be passed as the |this|
- * argument.
- */
-bool
-js::intrinsic_NewParallelArray(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    JS_ASSERT(args[0].isObject() && args[0].toObject().is<JSFunction>());
-
-    RootedFunction init(cx, &args[0].toObject().as<JSFunction>());
-    CallArgs args0 = CallArgsFromVp(argc - 1, vp + 1);
-    if (!js::ParallelArrayObject::constructHelper(cx, &init, args0))
-        return false;
-    args.rval().set(args0.rval());
-    return true;
-}
-
 /*
  * NewDenseArray(length): Allocates and returns a new dense array with
  * the given length where all values are initialized to holes.
@@ -640,7 +618,6 @@ static const JSFunctionSpec intrinsic_functions[] = {
 
     JS_FN("ForkJoin",                intrinsic_ForkJoin,                2,0),
     JS_FN("ForkJoinSlices",          intrinsic_ForkJoinSlices,          0,0),
-    JS_FN("NewParallelArray",        intrinsic_NewParallelArray,        3,0),
     JS_FN("NewDenseArray",           intrinsic_NewDenseArray,           1,0),
     JS_FN("ShouldForceSequential",   intrinsic_ShouldForceSequential,   0,0),
     JS_FN("ParallelTestsShouldPass", intrinsic_ParallelTestsShouldPass, 0,0),

From 36b2bcec465709fcbdbb7b8bbc30f3e3f42402ac Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 12 Dec 2013 23:19:55 -0800
Subject: [PATCH 022/144] Bug 944074 - Followup: undefined min and max from
 <windows.h> to prevent conflicts. (r=jandem)

---
 js/src/jswin.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/js/src/jswin.h b/js/src/jswin.h
index acab9e74a821..7cff6c84cb2d 100644
--- a/js/src/jswin.h
+++ b/js/src/jswin.h
@@ -14,6 +14,8 @@
 
 #ifdef XP_WIN
 # include <windows.h>
+# undef min
+# undef max
 # undef GetProp
 # undef SetProp
 # undef CONST

From 86b703757e390287ad38146b8ec63c97a6ba98b4 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 12 Dec 2013 23:23:57 -0800
Subject: [PATCH 023/144] Bug 949916 - Fix race between
 off-main-thread-compilation and PJS. (r=bhackett)

---
 js/src/jit/Ion.cpp     | 10 +++++-----
 js/src/jit/Ion.h       |  1 +
 js/src/jsworkers.cpp   |  6 +++---
 js/src/vm/ForkJoin.cpp | 13 ++++++++++++-
 4 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index ba3ee46a154d..3ca40db2aad5 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2454,8 +2454,8 @@ InvalidateActivation(FreeOp *fop, uint8_t *ionTop, bool invalidateAll)
     IonSpew(IonSpew_Invalidate, "END invalidating activation");
 }
 
-static void
-StopOffThreadCompilation(JSCompartment *comp)
+void
+jit::StopAllOffThreadCompilations(JSCompartment *comp)
 {
     if (!comp->jitCompartment())
         return;
@@ -2467,7 +2467,7 @@ void
 jit::InvalidateAll(FreeOp *fop, Zone *zone)
 {
     for (CompartmentsInZoneIter comp(zone); !comp.done(); comp.next())
-        StopOffThreadCompilation(comp);
+        StopAllOffThreadCompilations(comp);
 
     for (JitActivationIterator iter(fop->runtime()); !iter.done(); ++iter) {
         if (iter.activation()->compartment()->zone() == zone) {
@@ -2845,10 +2845,10 @@ AutoDebugModeInvalidation::~AutoDebugModeInvalidation()
     FreeOp *fop = rt->defaultFreeOp();
 
     if (comp_) {
-        StopOffThreadCompilation(comp_);
+        StopAllOffThreadCompilations(comp_);
     } else {
         for (CompartmentsInZoneIter comp(zone_); !comp.done(); comp.next())
-            StopOffThreadCompilation(comp);
+            StopAllOffThreadCompilations(comp);
     }
 
     if (invalidateStack) {
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 37ad4e778387..bf495ccf0e43 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -391,6 +391,7 @@ CodeGenerator *CompileBackEnd(MIRGenerator *mir, MacroAssembler *maybeMasm = nul
 
 void AttachFinishedCompilations(JSContext *cx);
 void FinishOffThreadBuilder(IonBuilder *builder);
+void StopAllOffThreadCompilations(JSCompartment *comp);
 
 static inline bool
 IsIonEnabled(JSContext *cx)
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index 61cf70e8eca8..0136601f6a2e 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -767,14 +767,14 @@ WorkerThread::handleIonWorkload(WorkerThreadState &state)
     FinishOffThreadIonCompile(ionBuilder);
     ionBuilder = nullptr;
 
-    // Notify the main thread in case it is waiting for the compilation to finish.
-    state.notifyAll(WorkerThreadState::CONSUMER);
-
     // Ping the main thread so that the compiled code can be incorporated
     // at the next operation callback. Don't interrupt Ion code for this, as
     // this incorporation can be delayed indefinitely without affecting
     // performance as long as the main thread is actually executing Ion code.
     runtime->triggerOperationCallback(JSRuntime::TriggerCallbackAnyThreadDontStopIon);
+
+    // Notify the main thread in case it is waiting for the compilation to finish.
+    state.notifyAll(WorkerThreadState::CONSUMER);
 }
 
 void
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index c60745b0cd1d..007d729c9218 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -867,8 +867,19 @@ js::ParallelDo::compileForParallelExecution(ExecutionStatus *status)
                 }
             }
         }
-        if (allScriptsPresent)
+
+        if (allScriptsPresent) {
+            // For testing modes, we want to make sure that all off thread
+            // compilation tasks are finished, so we don't race with
+            // off-main-thread-compilation setting an interrupt flag while we
+            // are in the middle of a test, causing unexpected bailouts.
+            if (mode_ != ForkJoinModeNormal) {
+                StopAllOffThreadCompilations(cx_->compartment());
+                if (!js_HandleExecutionInterrupt(cx_))
+                    return fatalError(status);
+            }
             break;
+        }
     }
 
     Spew(SpewCompile, "Compilation complete (final worklist length %d)",

From ef063fb0d4a6eecae13ecd2b915d1137bb60f4db Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Thu, 12 Dec 2013 23:33:50 -0800
Subject: [PATCH 024/144] Back out b6f9dbc91dc4 (bug 947038) for Cipc crashes

---
 dom/ipc/TabChild.cpp                          |   5 -
 gfx/layers/basic/BasicCompositor.cpp          | 155 ++++++++++++++++++
 gfx/layers/client/ContentClient.cpp           |   5 -
 gfx/layers/composite/TextureHost.cpp          |   8 +
 gfx/layers/composite/ThebesLayerComposite.cpp |   1 -
 gfx/thebes/gfxPlatform.cpp                    |  20 ---
 gfx/thebes/gfxPlatform.h                      |   5 +-
 widget/xpwidgets/nsBaseWidget.cpp             |   2 -
 8 files changed, 164 insertions(+), 37 deletions(-)

diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 7e88a30e1b88..8306641297ff 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -72,7 +72,6 @@
 #include "APZCCallbackHelper.h"
 #include "nsILoadContext.h"
 #include "ipc/nsGUIEventIPC.h"
-#include "gfxPlatform.h"
 
 #ifdef DEBUG
 #include "PCOMContentPermissionRequestChild.h"
@@ -2282,10 +2281,6 @@ TabChild::InitRenderingState()
           NS_WARNING("failed to properly allocate layer transaction");
           return false;
         }
-
-        // Track which compositor backend is in use (see bug 947038). This can
-        // be removed when deprecated textures are removed.
-        gfxPlatform::GetPlatform()->SetCompositorBackend(mTextureFactoryIdentifier.mParentBackend);
     } else {
         // Pushing transactions to the parent content.
         shadowManager = remoteFrame->SendPLayerTransactionConstructor();
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index 0bc966af4163..cc934831b3b8 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -63,6 +63,161 @@ public:
   RefPtr<gfx::DataSourceSurface> mSurface;
 };
 
+/**
+ * Texture source and host implementaion for software compositing.
+ */
+class DeprecatedTextureHostBasic : public DeprecatedTextureHost
+                                 , public TextureSourceBasic
+{
+public:
+  DeprecatedTextureHostBasic()
+  : mCompositor(nullptr)
+  {}
+
+  SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
+
+  virtual IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
+
+  virtual TextureSourceBasic* AsSourceBasic() MOZ_OVERRIDE { return this; }
+
+  SourceSurface *GetSurface() MOZ_OVERRIDE { return mSurface; }
+
+  virtual void SetCompositor(Compositor* aCompositor)
+  {
+    mCompositor = static_cast<BasicCompositor*>(aCompositor);
+  }
+
+  virtual const char *Name() { return "DeprecatedTextureHostBasic"; }
+
+protected:
+  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
+                          nsIntRegion *aRegion,
+                          nsIntPoint*) MOZ_OVERRIDE
+  {
+    AutoOpenSurface surf(OPEN_READ_ONLY, aImage);
+    nsRefPtr<gfxASurface> surface = ShadowLayerForwarder::OpenDescriptor(OPEN_READ_ONLY, aImage);
+    nsRefPtr<gfxImageSurface> image = surface->GetAsImageSurface();
+    mFormat = ImageFormatToSurfaceFormat(image->Format());
+    mSize = IntSize(image->Width(), image->Height());
+    mSurface = Factory::CreateWrappingDataSourceSurface(image->Data(),
+                                                        image->Stride(),
+                                                        mSize,
+                                                        mFormat);
+  }
+
+  virtual bool EnsureSurface() {
+    return true;
+  }
+
+  virtual bool Lock() MOZ_OVERRIDE {
+    return EnsureSurface();
+  }
+
+  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE {
+    if (!mSurface) {
+        return nullptr;
+    }
+    return mSurface->GetDataSurface();
+  }
+
+  BasicCompositor *mCompositor;
+  RefPtr<SourceSurface> mSurface;
+  IntSize mSize;
+  SurfaceFormat mFormat;
+};
+
+void
+DeserializerToPlanarYCbCrImageData(YCbCrImageDataDeserializer& aDeserializer, PlanarYCbCrData& aData)
+{
+  aData.mYChannel = aDeserializer.GetYData();
+  aData.mYStride = aDeserializer.GetYStride();
+  aData.mYSize = aDeserializer.GetYSize();
+  aData.mCbChannel = aDeserializer.GetCbData();
+  aData.mCrChannel = aDeserializer.GetCrData();
+  aData.mCbCrStride = aDeserializer.GetCbCrStride();
+  aData.mCbCrSize = aDeserializer.GetCbCrSize();
+  aData.mPicSize = aDeserializer.GetYSize();
+}
+
+class YCbCrDeprecatedTextureHostBasic : public DeprecatedTextureHostBasic
+{
+public:
+  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
+                          nsIntRegion *aRegion,
+                          nsIntPoint*) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
+    mSurface = nullptr;
+    ConvertImageToRGB(aImage);
+  }
+
+  virtual void SwapTexturesImpl(const SurfaceDescriptor& aImage,
+                                nsIntRegion* aRegion) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
+    mSurface = nullptr;
+  }
+
+  virtual bool EnsureSurface() MOZ_OVERRIDE
+  {
+    if (mSurface) {
+      return true;
+    }
+    if (!mBuffer) {
+      return false;
+    }
+    return ConvertImageToRGB(*mBuffer);
+  }
+
+  bool ConvertImageToRGB(const SurfaceDescriptor& aImage)
+  {
+    YCbCrImageDataDeserializer deserializer(aImage.get_YCbCrImage().data().get<uint8_t>());
+    PlanarYCbCrData data;
+    DeserializerToPlanarYCbCrImageData(deserializer, data);
+
+    gfxImageFormat format = gfxImageFormatRGB24;
+    gfxIntSize size;
+    gfxUtils::GetYCbCrToRGBDestFormatAndSize(data, format, size);
+    if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
+        size.height > PlanarYCbCrImage::MAX_DIMENSION) {
+      NS_ERROR("Illegal image dest width or height");
+      return false;
+    }
+
+    mSize = ToIntSize(size);
+    mFormat = (format == gfxImageFormatRGB24)
+              ? FORMAT_B8G8R8X8
+              : FORMAT_B8G8R8A8;
+
+    RefPtr<DataSourceSurface> surface = Factory::CreateDataSourceSurface(mSize, mFormat);
+    gfxUtils::ConvertYCbCrToRGB(data, format, size,
+                                surface->GetData(),
+                                surface->Stride());
+
+    mSurface = surface;
+    return true;
+  }
+};
+
+TemporaryRef<DeprecatedTextureHost>
+CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
+                             uint32_t aTextureHostFlags,
+                             uint32_t aTextureFlags)
+{
+  RefPtr<DeprecatedTextureHost> result = nullptr;
+  if (aDescriptorType == SurfaceDescriptor::TYCbCrImage) {
+    result = new YCbCrDeprecatedTextureHostBasic();
+  } else {
+    MOZ_ASSERT(aDescriptorType == SurfaceDescriptor::TShmem ||
+               aDescriptorType == SurfaceDescriptor::TMemoryImage,
+               "We can only support Shmem currently");
+    result = new DeprecatedTextureHostBasic();
+  }
+
+  result->SetFlags(aTextureFlags);
+  return result.forget();
+}
+
 BasicCompositor::BasicCompositor(nsIWidget *aWidget)
   : mWidget(aWidget)
 {
diff --git a/gfx/layers/client/ContentClient.cpp b/gfx/layers/client/ContentClient.cpp
index 157c01970fcf..544784812d91 100644
--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -58,11 +58,6 @@ ContentClient::CreateContentClient(CompositableForwarder* aForwarder)
   useDeprecatedTextures = gfxPlatform::GetPlatform()->UseDeprecatedTextures();
 #endif
 
-  // Always use new textures for the basic compositor.
-  if (backend == LAYERS_BASIC) {
-    useDeprecatedTextures = false;
-  }
-
 #ifdef XP_WIN
   if (backend == LAYERS_D3D11) {
     useDoubleBuffering = !!gfxWindowsPlatform::GetPlatform()->GetD2DDevice();
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 4caeb0b8030a..5e4da901d9ac 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -84,6 +84,10 @@ TextureHost::AsTextureHost(PTextureParent* actor)
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostOGL(SurfaceDescriptorType aDescriptorType,
                                                            uint32_t aDeprecatedTextureHostFlags,
                                                            uint32_t aTextureFlags);
+// implemented in BasicCompositor.cpp
+TemporaryRef<DeprecatedTextureHost> CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
+                                                             uint32_t aDeprecatedTextureHostFlags,
+                                                             uint32_t aTextureFlags);
 
 #ifdef XP_WIN
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostD3D9(SurfaceDescriptorType aDescriptorType,
@@ -123,6 +127,10 @@ DeprecatedTextureHost::CreateDeprecatedTextureHost(SurfaceDescriptorType aDescri
                                           aDeprecatedTextureHostFlags,
                                           aTextureFlags);
 #endif
+    case LAYERS_BASIC:
+      return CreateBasicDeprecatedTextureHost(aDescriptorType,
+                                          aDeprecatedTextureHostFlags,
+                                          aTextureFlags);
     default:
       MOZ_CRASH("Couldn't create texture host");
   }
diff --git a/gfx/layers/composite/ThebesLayerComposite.cpp b/gfx/layers/composite/ThebesLayerComposite.cpp
index 7a9cc3f00c45..1f35533634d0 100644
--- a/gfx/layers/composite/ThebesLayerComposite.cpp
+++ b/gfx/layers/composite/ThebesLayerComposite.cpp
@@ -138,7 +138,6 @@ ThebesLayerComposite::RenderLayer(const nsIntRect& aClipRect)
 
   mBuffer->SetPaintWillResample(MayResample());
 
-  mBuffer->SetCompositor(mCompositeManager->GetCompositor());
   mBuffer->Composite(effectChain,
                      GetEffectiveOpacity(),
                      transform,
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 89c74cc2c52e..b563f75429e4 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -281,7 +281,6 @@ gfxPlatform::gfxPlatform()
   , mDrawLayerBorders(false)
   , mDrawTileBorders(false)
   , mDrawBigImageBorders(false)
-  , mCompositorBackend(LAYERS_NONE)
 {
     mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
     mAllowDownloadableFonts = UNINITIALIZED_VALUE;
@@ -2214,22 +2213,3 @@ gfxPlatform::ComponentAlphaEnabled()
   InitLayersAccelerationPrefs();
   return sComponentAlphaEnabled;
 }
-
-void
-gfxPlatform::SetCompositorBackend(mozilla::layers::LayersBackend backend)
-{
-  // The compositor backend should always be the same after one has been chosen.
-  MOZ_ASSERT(mCompositorBackend == LAYERS_NONE || mCompositorBackend == backend);
-  if (mCompositorBackend == LAYERS_NONE) {
-    mCompositorBackend = backend;
-  }
-}
-
-bool
-gfxPlatform::UseDeprecatedTextures() const
-{
-  if (mCompositorBackend == LAYERS_BASIC) {
-    return false;
-  }
-  return mLayersUseDeprecated;
-}
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 64d138698558..27ff830fd51e 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -20,7 +20,6 @@
 #include "mozilla/RefPtr.h"
 #include "GfxInfoCollector.h"
 
-#include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/CompositorTypes.h"
 
 #ifdef XP_OS2
@@ -620,8 +619,7 @@ public:
      * This method should not be called from the compositor thread.
      */
     bool PreferMemoryOverShmem() const;
-    bool UseDeprecatedTextures() const;
-    void SetCompositorBackend(mozilla::layers::LayersBackend backend);
+    bool UseDeprecatedTextures() const { return mLayersUseDeprecated; }
 
 protected:
     gfxPlatform();
@@ -738,7 +736,6 @@ private:
     bool mDrawLayerBorders;
     bool mDrawTileBorders;
     bool mDrawBigImageBorders;
-    mozilla::layers::LayersBackend mCompositorBackend;
 };
 
 #endif /* GFX_PLATFORM_H */
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index f8f4ce68d058..1916ced3277d 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -988,8 +988,6 @@ void nsBaseWidget::CreateCompositor(int aWidth, int aHeight)
     ImageBridgeChild::IdentifyCompositorTextureHost(textureFactoryIdentifier);
     WindowUsesOMTC();
 
-    gfxPlatform::GetPlatform()->SetCompositorBackend(textureFactoryIdentifier.mParentBackend);
-
     mLayerManager = lm;
     return;
   }

From abf326e01b4a344e13d26de7437c41495404ac64 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 16:06:53 +0900
Subject: [PATCH 025/144] Bug 949906 - Add a callback to modify evaluated
 moz.build sandboxes, fix Sphinx docs; r=glandium

--HG--
extra : rebase_source : 9ef2219145fb754a9cbe9e7e30b6f2841910f13f
---
 python/mozbuild/mozbuild/frontend/reader.py   | 16 ++++++++++++++-
 .../mozbuild/test/frontend/test_reader.py     | 20 +++++++++++++++++--
 tools/docs/mach_commands.py                   |  9 ++++++++-
 3 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/python/mozbuild/mozbuild/frontend/reader.py b/python/mozbuild/mozbuild/frontend/reader.py
index 76ee9d0c866e..da87965ea099 100644
--- a/python/mozbuild/mozbuild/frontend/reader.py
+++ b/python/mozbuild/mozbuild/frontend/reader.py
@@ -592,13 +592,20 @@ class BuildReader(object):
     This is where the build system starts. You give it a tree configuration
     (the output of configuration) and it executes the moz.build files and
     collects the data they define.
+
+    The reader can optionally call a callable after each sandbox is evaluated
+    but before its evaluated content is processed. This gives callers the
+    opportunity to modify sandboxes before side-effects occur from their
+    content. This callback receives the ``Sandbox`` that was evaluated. The
+    return value is ignored.
     """
 
-    def __init__(self, config):
+    def __init__(self, config, sandbox_post_eval_cb=None):
         self.config = config
         self.topsrcdir = config.topsrcdir
         self.topobjdir = config.topobjdir
 
+        self._sandbox_post_eval_cb = sandbox_post_eval_cb
         self._log = logging.getLogger(__name__)
         self._read_files = set()
         self._execution_stack = []
@@ -719,6 +726,10 @@ class BuildReader(object):
         sandbox = MozbuildSandbox(self.config, path, metadata=metadata)
         sandbox.exec_file(path, filesystem_absolute=filesystem_absolute)
         sandbox.execution_time = time.time() - time_start
+
+        if self._sandbox_post_eval_cb:
+            self._sandbox_post_eval_cb(sandbox)
+
         var = metadata.get('var', None)
         forbidden = {
             'TOOL_DIRS': ['DIRS', 'PARALLEL_DIRS', 'TEST_DIRS'],
@@ -770,6 +781,9 @@ class BuildReader(object):
         # so until the library linking operations are moved out of it, at which
         # point PARALLEL_DIRS will be irrelevant anyways.
         for gyp_sandbox in gyp_sandboxes:
+            if self._sandbox_post_eval_cb:
+                self._sandbox_post_eval_cb(gyp_sandbox)
+
             sandbox['DIRS'].append(mozpath.relpath(gyp_sandbox['OBJDIR'], sandbox['OBJDIR']))
 
         yield sandbox
diff --git a/python/mozbuild/mozbuild/test/frontend/test_reader.py b/python/mozbuild/mozbuild/test/frontend/test_reader.py
index 2d2bf672e38c..d057ef8335bc 100644
--- a/python/mozbuild/mozbuild/test/frontend/test_reader.py
+++ b/python/mozbuild/mozbuild/test/frontend/test_reader.py
@@ -33,13 +33,13 @@ class TestBuildReader(unittest.TestCase):
 
         return MockConfig(path, **kwargs)
 
-    def reader(self, name, enable_tests=False):
+    def reader(self, name, enable_tests=False, **kwargs):
         extra = {}
         if enable_tests:
             extra['ENABLE_TESTS'] = '1'
         config = self.config(name, extra_substs=extra)
 
-        return BuildReader(config)
+        return BuildReader(config, **kwargs)
 
     def file_path(self, name, *args):
         return mozpath.join(data_path, name, *args)
@@ -266,5 +266,21 @@ class TestBuildReader(unittest.TestCase):
         self.assertEqual([sandbox['XPIDL_MODULE'] for sandbox in sandboxes],
             ['foobar', 'foobar', 'foobar', 'foobar'])
 
+    def test_process_eval_callback(self):
+        def strip_dirs(sandbox):
+            sandbox['DIRS'][:] = []
+            count[0] += 1
+
+        reader = self.reader('traversal-simple',
+            sandbox_post_eval_cb=strip_dirs)
+
+        count = [0]
+
+        sandboxes = list(reader.read_topsrcdir())
+
+        self.assertEqual(len(sandboxes), 1)
+        self.assertEqual(len(count), 1)
+
+
 if __name__ == '__main__':
     main()
diff --git a/tools/docs/mach_commands.py b/tools/docs/mach_commands.py
index b1bbb4b923b4..7948f2490de6 100644
--- a/tools/docs/mach_commands.py
+++ b/tools/docs/mach_commands.py
@@ -38,7 +38,14 @@ class Documentation(MachCommandBase):
         manager = SphinxManager(self.topsrcdir, os.path.join(self.topsrcdir,
             'tools', 'docs'), outdir)
 
-        reader = BuildReader(self.config_environment)
+        # We don't care about GYP projects, so don't process them. This makes
+        # scanning faster and may even prevent an exception.
+        def remove_gyp_dirs(sandbox):
+            sandbox['GYP_DIRS'][:] = []
+
+        reader = BuildReader(self.config_environment,
+            sandbox_post_eval_cb=remove_gyp_dirs)
+
         for sandbox in reader.walk_topsrcdir():
             for dest_dir, source_dir in sandbox['SPHINX_TREES'].items():
                 manager.add_tree(os.path.join(sandbox['RELATIVEDIR'],

From 3ec0b0a106095e0d914f72026429806ae675cfb3 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Wed, 13 Nov 2013 15:41:22 -0800
Subject: [PATCH 026/144] Bug 928195 - Part 6: Add docs for WebIDL and the
 build system; r=froydnj

--HG--
extra : rebase_source : cee29c0bf5c050d73ef02d6ad933802b8fad21e0
---
 dom/bindings/docs/index.rst | 122 ++++++++++++++++++++++++++++++++++++
 dom/bindings/moz.build      |   3 +
 2 files changed, 125 insertions(+)
 create mode 100644 dom/bindings/docs/index.rst

diff --git a/dom/bindings/docs/index.rst b/dom/bindings/docs/index.rst
new file mode 100644
index 000000000000..16a92b64dba9
--- /dev/null
+++ b/dom/bindings/docs/index.rst
@@ -0,0 +1,122 @@
+.. _webidl:
+
+======
+WebIDL
+======
+
+WebIDL describes interfaces web browsers are supposed to implement.
+
+The interaction between WebIDL and the build system is somewhat complex.
+This document will attempt to explain how it all works.
+
+Overview
+========
+
+``.webidl`` files throughout the tree define interfaces the browser
+implements. Since Gecko/Firefox is implemented in C++, there is a
+mechanism to convert these interfaces and associated metadata to
+C++ code. That's where the build system comes into play.
+
+All the code for interacting with ``.webidl`` files lives under
+``dom/bindings``. There is code in the build system to deal with
+WebIDLs explicitly.
+
+WebIDL source file flavors
+==========================
+
+Not all ``.webidl`` files are created equal! There are several flavors,
+each represented by a separate symbol from :ref:`mozbuild_symbols`.
+
+WEBIDL_FILES
+   Refers to regular/static ``.webidl`` files. Most WebIDL interfaces
+   are defined this way.
+
+GENERATED_EVENTS_WEBIDL_FILES
+   In addition to generating a binding, these ``.webidl`` files also
+   generate a source file implementing the event object in C++
+
+PREPROCESSED_WEBIDL_FILES
+   The ``.webidl`` files are generated by preprocessing an input file.
+   They otherwise behave like *WEBIDL_FILES*.
+
+TEST_WEBIDL_FILES
+   Like *WEBIDL_FILES* but the interfaces are for testing only and
+   aren't shipped with the browser.
+
+PREPROCESSED_TEST_WEBIDL_FILES
+   Like *TEST_WEBIDL_FILES* except the ``.webidl`` is obtained via
+   preprocessing, much like *PREPROCESSED_WEBIDL_FILES*.
+
+GENERATED_WEBIDL_FILES
+   The ``.webidl`` for these is obtained through an *external*
+   mechanism. Typically there are custom build rules for producing these
+   files.
+
+Producing C++ code
+==================
+
+The most complicated part about WebIDLs is the process by which
+``.webidl`` files are converted into C++.
+
+This process is handled by code in the :py:mod:`mozwebidlcodegen`
+package. :py:class:`mozwebidlcodegen.WebIDLCodegenManager` is
+specifically where you want to look for how code generation is
+performed. This includes complex dependency management.
+
+Requirements
+============
+
+This section aims to document the build and developer workflow requirements
+for WebIDL.
+
+Parser unit tests
+   There are parser tests provided by ``dom/bindings/parser/runtests.py``
+   that should run as part of ``make check``. There must be a mechanism
+   to run the tests in *human* mode so they output friendly error
+   messages.
+
+   The current mechanism for this is ``mach webidl-parser-test``.
+
+Mochitests
+   There are various mochitests under ``dom/bindings/test``. They should
+   be runnable through the standard mechanisms.
+
+Working with test interfaces
+   ``TestExampleGenBinding.cpp`` calls into methods from the
+   ``TestExampleInterface`` and ``TestExampleProxyInterface`` interfaces.
+   These interfaces need to be generated as part of the build. These
+   interfaces should not be exported or packaged.
+
+   There is a ``compiletests`` make target in ``dom/bindings`` that
+   isn't part of the build that facilitates turnkey code generation
+   and test file compilation.
+
+Minimal rebuilds
+   Reprocessing every output for every change is expensive. So we don't
+   inconvenience people changing ``.webidl`` files, the build system
+   should only perform a minimal rebuild when sources change.
+
+   This logic is mostly all handled in
+   :py:class:`mozwebidlcodegen.WebIDLCodegenManager`. The unit tests for
+   that Python code should adequately test typical rebuild scenarios.
+
+   Bug 940469 tracks making the existing implementation better.
+
+Explicit method for performing codegen
+   There needs to be an explicit method for invoking code generation.
+   It needs to cover regular and test files.
+
+   This is implemented via ``make export`` in ``dom/bindings``.
+
+No-op binding generation should be fast
+   So developers touching ``.webidl`` files are not inconvenienced,
+   no-op binding generation should be fast. Watch out for the build system
+   processing large dependency files it doesn't need in order to perform
+   code generation.
+
+Ability to generate example files
+   *Any* interface can have example ``.h``/``.cpp`` files generated.
+   There must be a mechanism to facilitate this.
+
+   This is currently facilitated through ``mach webidl-example``. e.g.
+   ``mach webidl-example HTMLStyleElement``.
diff --git a/dom/bindings/moz.build b/dom/bindings/moz.build
index 557d4a63e92f..acb65bedc69d 100644
--- a/dom/bindings/moz.build
+++ b/dom/bindings/moz.build
@@ -87,3 +87,6 @@ if CONFIG['MOZ_AUDIO_CHANNEL_MANAGER']:
     ]
 
 FINAL_LIBRARY = 'xul'
+
+SPHINX_TREES['webidl'] = 'docs'
+SPHINX_PYTHON_PACKAGE_DIRS += ['mozwebidlcodegen']

From 7da8970d0e765fd024b89506587929f60740dd14 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 08:34:24 +0000
Subject: [PATCH 027/144] Bug 944442 - DeCOMify imgIContainer::GetFrame. r=seth

--HG--
extra : rebase_source : 612c1923f3ed8a01fc30f2d306b4682e585e53fe
---
 .../shell/src/nsWindowsShellService.cpp       |  7 ++--
 content/svg/content/src/SVGFEImageElement.cpp |  6 +--
 image/public/imgIContainer.idl                |  6 ++-
 image/src/ClippedImage.cpp                    | 22 ++++------
 image/src/ClippedImage.h                      | 14 +++----
 image/src/FrozenImage.cpp                     |  7 ++--
 image/src/FrozenImage.h                       |  5 +--
 image/src/ImageWrapper.cpp                    |  7 ++--
 image/src/OrientedImage.cpp                   | 18 ++++----
 image/src/OrientedImage.h                     |  5 +--
 image/src/RasterImage.cpp                     | 41 ++++++++-----------
 image/src/VectorImage.cpp                     | 18 ++++----
 image/src/imgTools.cpp                        |  7 ++--
 layout/base/nsLayoutUtils.cpp                 |  8 ++--
 widget/cocoa/nsClipboard.mm                   |  7 ++--
 widget/cocoa/nsCocoaUtils.mm                  |  6 +--
 widget/cocoa/nsMenuItemIconX.mm               |  7 ++--
 widget/gtk/nsImageToPixbuf.cpp                | 12 +++---
 widget/os2/nsWindow.cpp                       |  7 ++--
 widget/qt/nsClipboard.cpp                     |  7 ++--
 widget/windows/WinUtils.cpp                   |  4 +-
 widget/windows/nsImageClipboard.cpp           |  7 ++--
 widget/windows/nsWindowGfx.cpp                |  7 ++--
 23 files changed, 100 insertions(+), 135 deletions(-)

diff --git a/browser/components/shell/src/nsWindowsShellService.cpp b/browser/components/shell/src/nsWindowsShellService.cpp
index 35b9bcfc46f0..908508639a97 100644
--- a/browser/components/shell/src/nsWindowsShellService.cpp
+++ b/browser/components/shell/src/nsWindowsShellService.cpp
@@ -752,10 +752,9 @@ WriteBitmap(nsIFile* aFile, imgIContainer* aImage)
 {
   nsresult rv;
 
-  nsRefPtr<gfxASurface> surface;
-  aImage->GetFrame(imgIContainer::FRAME_FIRST,
-                   imgIContainer::FLAG_SYNC_DECODE,
-                   getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aImage->GetFrame(imgIContainer::FRAME_FIRST,
+                     imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
   nsRefPtr<gfxImageSurface> image(surface->GetAsReadableARGB32ImageSurface());
diff --git a/content/svg/content/src/SVGFEImageElement.cpp b/content/svg/content/src/SVGFEImageElement.cpp
index 5ebf78c9d0f7..c91795c30447 100644
--- a/content/svg/content/src/SVGFEImageElement.cpp
+++ b/content/svg/content/src/SVGFEImageElement.cpp
@@ -211,9 +211,9 @@ SVGFEImageElement::GetPrimitiveDescription(nsSVGFilterInstance* aInstance,
 
   nsRefPtr<gfxASurface> currentFrame;
   if (imageContainer) {
-    imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
-                             imgIContainer::FLAG_SYNC_DECODE,
-                             getter_AddRefs(currentFrame));
+    currentFrame =
+      imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
+                               imgIContainer::FLAG_SYNC_DECODE);
   }
 
   if (!currentFrame) {
diff --git a/image/public/imgIContainer.idl b/image/public/imgIContainer.idl
index 3bcfc05689fd..884f27e30838 100644
--- a/image/public/imgIContainer.idl
+++ b/image/public/imgIContainer.idl
@@ -55,6 +55,7 @@ native nsSize(nsSize);
 native Orientation(mozilla::image::Orientation);
 [ref] native TimeStamp(mozilla::TimeStamp);
 [ptr] native SVGImageContext(mozilla::SVGImageContext);
+native already_AddRefed_gfxASurface(already_AddRefed<gfxASurface>);
 
 
 /**
@@ -64,7 +65,7 @@ native Orientation(mozilla::image::Orientation);
  *
  * Internally, imgIContainer also manages animation of images.
  */
-[scriptable, builtinclass, uuid(73340b79-e3ae-4f02-97d0-822db78017e5)]
+[scriptable, builtinclass, uuid(8b7db7dd-bfe9-40d3-9114-3a79c0658afd)]
 interface imgIContainer : nsISupports
 {
   /**
@@ -172,7 +173,8 @@ interface imgIContainer : nsISupports
    * @param aWhichFrame Frame specifier of the FRAME_* variety.
    * @param aFlags Flags of the FLAG_* variety
    */
-  [noscript] gfxASurface getFrame(in uint32_t aWhichFrame,
+  [noscript, notxpcom] already_AddRefed_gfxASurface
+                         getFrame(in uint32_t aWhichFrame,
                                   in uint32_t aFlags);
 
   /**
diff --git a/image/src/ClippedImage.cpp b/image/src/ClippedImage.cpp
index d5cf33ca1578..c09e8d2aa4c6 100644
--- a/image/src/ClippedImage.cpp
+++ b/image/src/ClippedImage.cpp
@@ -209,23 +209,21 @@ ClippedImage::GetIntrinsicRatio(nsSize* aRatio)
   return NS_OK;
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 ClippedImage::GetFrame(uint32_t aWhichFrame,
-                       uint32_t aFlags,
-                       gfxASurface** _retval)
+                       uint32_t aFlags)
 {
-  return GetFrameInternal(mClip.Size(), nullptr, aWhichFrame, aFlags, _retval);
+  return GetFrameInternal(mClip.Size(), nullptr, aWhichFrame, aFlags);
 }
 
-nsresult
+already_AddRefed<gfxASurface>
 ClippedImage::GetFrameInternal(const nsIntSize& aViewportSize,
                                const SVGImageContext* aSVGContext,
                                uint32_t aWhichFrame,
-                               uint32_t aFlags,
-                               gfxASurface** _retval)
+                               uint32_t aFlags)
 {
   if (!ShouldClip()) {
-    return InnerImage()->GetFrame(aWhichFrame, aFlags, _retval);
+    return InnerImage()->GetFrame(aWhichFrame, aFlags);
   }
 
   float frameToDraw = InnerImage()->GetFrameIndex(aWhichFrame);
@@ -273,9 +271,7 @@ ClippedImage::GetFrameInternal(const nsIntSize& aViewportSize,
   }
 
   MOZ_ASSERT(mCachedSurface, "Should have a cached surface now");
-  nsRefPtr<gfxASurface> surf = mCachedSurface->Surface();
-  surf.forget(_retval);
-  return NS_OK;
+  return mCachedSurface->Surface();
 }
 
 NS_IMETHODIMP
@@ -335,8 +331,8 @@ ClippedImage::Draw(gfxContext* aContext,
   if (MustCreateSurface(aContext, aUserSpaceToImageSpace, sourceRect, aSubimage, aFlags)) {
     // Create a temporary surface containing a single tile of this image.
     // GetFrame will call DrawSingleTile internally.
-    nsRefPtr<gfxASurface> surface;
-    GetFrameInternal(aViewportSize, aSVGContext, aWhichFrame, aFlags, getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      GetFrameInternal(aViewportSize, aSVGContext, aWhichFrame, aFlags);
     NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
     // Create a drawable from that surface.
diff --git a/image/src/ClippedImage.h b/image/src/ClippedImage.h
index 51bffa5f5805..69c609fdece1 100644
--- a/image/src/ClippedImage.h
+++ b/image/src/ClippedImage.h
@@ -35,9 +35,8 @@ public:
   NS_IMETHOD GetHeight(int32_t* aHeight) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicSize(nsSize* aSize) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicRatio(nsSize* aRatio) MOZ_OVERRIDE;
-  NS_IMETHOD GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<gfxASurface>) GetFrame(uint32_t aWhichFrame,
+                                                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD GetImageContainer(mozilla::layers::LayerManager* aManager,
                                mozilla::layers::ImageContainer** _retval) MOZ_OVERRIDE;
   NS_IMETHOD Draw(gfxContext* aContext,
@@ -56,11 +55,10 @@ protected:
   ClippedImage(Image* aImage, nsIntRect aClip);
 
 private:
-  nsresult GetFrameInternal(const nsIntSize& aViewportSize,
-                            const SVGImageContext* aSVGContext,
-                            uint32_t aWhichFrame,
-                            uint32_t aFlags,
-                            gfxASurface** _retval);
+  already_AddRefed<gfxASurface> GetFrameInternal(const nsIntSize& aViewportSize,
+                                                 const SVGImageContext* aSVGContext,
+                                                 uint32_t aWhichFrame,
+                                                 uint32_t aFlags);
   bool ShouldClip();
   bool MustCreateSurface(gfxContext* aContext,
                          const gfxMatrix& aTransform,
diff --git a/image/src/FrozenImage.cpp b/image/src/FrozenImage.cpp
index a308fbc914b0..2b2607953449 100644
--- a/image/src/FrozenImage.cpp
+++ b/image/src/FrozenImage.cpp
@@ -40,12 +40,11 @@ FrozenImage::GetAnimated(bool* aAnimated)
   return rv;
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 FrozenImage::GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval)
+                      uint32_t aFlags)
 {
-  return InnerImage()->GetFrame(FRAME_FIRST, aFlags, _retval);
+  return InnerImage()->GetFrame(FRAME_FIRST, aFlags);
 }
 
 NS_IMETHODIMP_(bool)
diff --git a/image/src/FrozenImage.h b/image/src/FrozenImage.h
index 3cb1e8e33aef..947dc322a553 100644
--- a/image/src/FrozenImage.h
+++ b/image/src/FrozenImage.h
@@ -34,9 +34,8 @@ public:
   virtual void DecrementAnimationConsumers() MOZ_OVERRIDE;
 
   NS_IMETHOD GetAnimated(bool* aAnimated) MOZ_OVERRIDE;
-  NS_IMETHOD GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<gfxASurface>) GetFrame(uint32_t aWhichFrame,
+                                                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD_(bool) FrameIsOpaque(uint32_t aWhichFrame) MOZ_OVERRIDE;
   NS_IMETHOD GetImageContainer(layers::LayerManager* aManager,
                                layers::ImageContainer** _retval) MOZ_OVERRIDE;
diff --git a/image/src/ImageWrapper.cpp b/image/src/ImageWrapper.cpp
index 6e2c9adddf6c..aaba02f77c96 100644
--- a/image/src/ImageWrapper.cpp
+++ b/image/src/ImageWrapper.cpp
@@ -196,12 +196,11 @@ ImageWrapper::GetAnimated(bool* aAnimated)
   return mInnerImage->GetAnimated(aAnimated);
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 ImageWrapper::GetFrame(uint32_t aWhichFrame,
-                       uint32_t aFlags,
-                       gfxASurface** _retval)
+                       uint32_t aFlags)
 {
-  return mInnerImage->GetFrame(aWhichFrame, aFlags, _retval);
+  return mInnerImage->GetFrame(aWhichFrame, aFlags);
 }
 
 NS_IMETHODIMP_(bool)
diff --git a/image/src/OrientedImage.cpp b/image/src/OrientedImage.cpp
index fb3ae9c52955..24d4e3b79413 100644
--- a/image/src/OrientedImage.cpp
+++ b/image/src/OrientedImage.cpp
@@ -75,15 +75,14 @@ OrientedImage::GetIntrinsicRatio(nsSize* aRatio)
   return rv;
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 OrientedImage::GetFrame(uint32_t aWhichFrame,
-                        uint32_t aFlags,
-                        gfxASurface** _retval)
+                        uint32_t aFlags)
 {
   nsresult rv;
 
   if (mOrientation.IsIdentity()) {
-    return InnerImage()->GetFrame(aWhichFrame, aFlags, _retval);
+    return InnerImage()->GetFrame(aWhichFrame, aFlags);
   }
 
   // Get the underlying dimensions.
@@ -95,7 +94,7 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
     rv = InnerImage()->GetWidth(&width);
     rv = NS_FAILED(rv) ? rv : InnerImage()->GetHeight(&height);
   }
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, nullptr);
 
   // Determine an appropriate format for the surface.
   gfx::SurfaceFormat surfaceFormat;
@@ -116,9 +115,9 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
     GetThebesSurfaceForDrawTarget(target);
 
   // Create our drawable.
-  nsRefPtr<gfxASurface> innerSurface;
-  rv = InnerImage()->GetFrame(aWhichFrame, aFlags, getter_AddRefs(innerSurface));
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsRefPtr<gfxASurface> innerSurface =
+    InnerImage()->GetFrame(aWhichFrame, aFlags);
+  NS_ENSURE_TRUE(innerSurface, nullptr);
   nsRefPtr<gfxDrawable> drawable =
     new gfxSurfaceDrawable(innerSurface, gfxIntSize(width, height));
 
@@ -129,8 +128,7 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
                              imageRect, imageRect, imageRect, imageRect,
                              imageFormat, GraphicsFilter::FILTER_FAST);
 
-  surface.forget(_retval);
-  return NS_OK;
+  return surface.forget();
 }
 
 NS_IMETHODIMP
diff --git a/image/src/OrientedImage.h b/image/src/OrientedImage.h
index 6f4c209efdf0..1c1886bd655e 100644
--- a/image/src/OrientedImage.h
+++ b/image/src/OrientedImage.h
@@ -32,9 +32,8 @@ public:
   NS_IMETHOD GetHeight(int32_t* aHeight) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicSize(nsSize* aSize) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicRatio(nsSize* aRatio) MOZ_OVERRIDE;
-  NS_IMETHOD GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<gfxASurface>) GetFrame(uint32_t aWhichFrame,
+                                                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD GetImageContainer(mozilla::layers::LayerManager* aManager,
                                mozilla::layers::ImageContainer** _retval) MOZ_OVERRIDE;
   NS_IMETHOD Draw(gfxContext* aContext,
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index 39a8d2b0a3ce..f224c362a909 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -879,30 +879,29 @@ RasterImage::CopyFrame(uint32_t aWhichFrame,
 //******************************************************************************
 /* [noscript] gfxASurface getFrame(in uint32_t aWhichFrame,
  *                                 in uint32_t aFlags); */
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 RasterImage::GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface **_retval)
+                      uint32_t aFlags)
 {
+  MOZ_ASSERT(aWhichFrame <= FRAME_MAX_VALUE);
+
   if (aWhichFrame > FRAME_MAX_VALUE)
-    return NS_ERROR_INVALID_ARG;
+    return nullptr;
 
   if (mError)
-    return NS_ERROR_FAILURE;
+    return nullptr;
 
   // Disallowed in the API
   if (mInDecoder && (aFlags & imgIContainer::FLAG_SYNC_DECODE))
-    return NS_ERROR_FAILURE;
-
-  nsresult rv = NS_OK;
+    return nullptr;
 
   if (!ApplyDecodeFlags(aFlags))
-    return NS_ERROR_NOT_AVAILABLE;
+    return nullptr;
 
   // If the caller requested a synchronous decode, do it
   if (aFlags & FLAG_SYNC_DECODE) {
-    rv = SyncDecode();
-    CONTAINER_ENSURE_SUCCESS(rv);
+    nsresult rv = SyncDecode();
+    CONTAINER_ENSURE_TRUE(NS_SUCCEEDED(rv), nullptr);
   }
 
   // Get the frame. If it's not there, it's probably the caller's fault for
@@ -912,8 +911,7 @@ RasterImage::GetFrame(uint32_t aWhichFrame,
                           0 : GetCurrentImgFrameIndex();
   imgFrame *frame = GetDrawableImgFrame(frameIndex);
   if (!frame) {
-    *_retval = nullptr;
-    return NS_ERROR_FAILURE;
+    return nullptr;
   }
 
   nsRefPtr<gfxASurface> framesurf;
@@ -924,19 +922,17 @@ RasterImage::GetFrame(uint32_t aWhichFrame,
   if (framerect.x == 0 && framerect.y == 0 &&
       framerect.width == mSize.width &&
       framerect.height == mSize.height)
-    rv = frame->GetSurface(getter_AddRefs(framesurf));
+    frame->GetSurface(getter_AddRefs(framesurf));
 
   // The image doesn't have a surface because it's been optimized away. Create
   // one.
   if (!framesurf) {
     nsRefPtr<gfxImageSurface> imgsurf;
-    rv = CopyFrame(aWhichFrame, aFlags, getter_AddRefs(imgsurf));
+    CopyFrame(aWhichFrame, aFlags, getter_AddRefs(imgsurf));
     framesurf = imgsurf;
   }
 
-  *_retval = framesurf.forget().get();
-
-  return rv;
+  return framesurf.forget();
 }
 
 already_AddRefed<layers::Image>
@@ -949,13 +945,8 @@ RasterImage::GetCurrentImage()
     return nullptr;
   }
 
-  nsRefPtr<gfxASurface> imageSurface;
-  nsresult rv = GetFrame(FRAME_CURRENT, FLAG_NONE, getter_AddRefs(imageSurface));
-  NS_ENSURE_SUCCESS(rv, nullptr);
-
-  if (!imageSurface) {
-    return nullptr;
-  }
+  nsRefPtr<gfxASurface> imageSurface = GetFrame(FRAME_CURRENT, FLAG_NONE);
+  NS_ENSURE_TRUE(imageSurface, nullptr);
 
   if (!mImageContainer) {
     mImageContainer = LayerManager::CreateImageContainer();
diff --git a/image/src/VectorImage.cpp b/image/src/VectorImage.cpp
index e99c7a1f4fc3..aaadb9cc9b1c 100644
--- a/image/src/VectorImage.cpp
+++ b/image/src/VectorImage.cpp
@@ -647,18 +647,17 @@ VectorImage::FrameIsOpaque(uint32_t aWhichFrame)
 //******************************************************************************
 /* [noscript] gfxASurface getFrame(in uint32_t aWhichFrame,
  *                                 in uint32_t aFlags; */
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 VectorImage::GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval)
+                      uint32_t aFlags)
 {
-  NS_ENSURE_ARG_POINTER(_retval);
+  MOZ_ASSERT(aWhichFrame <= FRAME_MAX_VALUE);
 
   if (aWhichFrame > FRAME_MAX_VALUE)
-    return NS_ERROR_INVALID_ARG;
+    return nullptr;
 
   if (mError)
-    return NS_ERROR_FAILURE;
+    return nullptr;
 
   // Look up height & width
   // ----------------------
@@ -668,7 +667,7 @@ VectorImage::GetFrame(uint32_t aWhichFrame,
       !mSVGDocumentWrapper->GetWidthOrHeight(SVGDocumentWrapper::eHeight,
                                              imageIntSize.height)) {
     // We'll get here if our SVG doc has a percent-valued width or height.
-    return NS_ERROR_FAILURE;
+    return nullptr;
   }
 
   // Create a surface that we'll ultimately return
@@ -689,9 +688,8 @@ VectorImage::GetFrame(uint32_t aWhichFrame,
                      nsIntRect(nsIntPoint(0,0), imageIntSize),
                      imageIntSize, nullptr, aWhichFrame, aFlags);
 
-  NS_ENSURE_SUCCESS(rv, rv);
-  *_retval = surface.forget().get();
-  return rv;
+  NS_ENSURE_SUCCESS(rv, nullptr);
+  return surface.forget();
 }
 
 //******************************************************************************
diff --git a/image/src/imgTools.cpp b/image/src/imgTools.cpp
index 0dd5640ed8ee..30a6b5c59ea5 100644
--- a/image/src/imgTools.cpp
+++ b/image/src/imgTools.cpp
@@ -276,10 +276,9 @@ NS_IMETHODIMP imgTools::EncodeImageData(gfxImageSurface *aSurface,
 NS_IMETHODIMP imgTools::GetFirstImageFrame(imgIContainer *aContainer,
                                            gfxImageSurface **aSurface)
 {
-  nsRefPtr<gfxASurface> surface;
-  aContainer->GetFrame(imgIContainer::FRAME_FIRST,
-                       imgIContainer::FLAG_SYNC_DECODE,
-                       getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aContainer->GetFrame(imgIContainer::FRAME_FIRST,
+                         imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_NOT_AVAILABLE);
 
   nsRefPtr<gfxImageSurface> frame(surface->CopyToARGB32ImageSurface());
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index aef7bb43b61a..898e2f75df38 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -4816,11 +4816,9 @@ nsLayoutUtils::SurfaceFromElement(nsIImageLoadingContent* aElement,
     frameFlags |= imgIContainer::FLAG_DECODE_NO_COLORSPACE_CONVERSION;
   if (aSurfaceFlags & SFE_NO_PREMULTIPLY_ALPHA)
     frameFlags |= imgIContainer::FLAG_DECODE_NO_PREMULTIPLY_ALPHA;
-  nsRefPtr<gfxASurface> framesurf;
-  rv = imgContainer->GetFrame(whichFrame,
-                              frameFlags,
-                              getter_AddRefs(framesurf));
-  if (NS_FAILED(rv))
+  nsRefPtr<gfxASurface> framesurf =
+    imgContainer->GetFrame(whichFrame, frameFlags);
+  if (!framesurf)
     return result;
 
   int32_t imgWidth, imgHeight;
diff --git a/widget/cocoa/nsClipboard.mm b/widget/cocoa/nsClipboard.mm
index 6e8973dcd054..33f430424e4a 100644
--- a/widget/cocoa/nsClipboard.mm
+++ b/widget/cocoa/nsClipboard.mm
@@ -431,10 +431,9 @@ nsClipboard::PasteboardDictFromTransferable(nsITransferable* aTransferable)
         continue;
       }
 
-      nsRefPtr<gfxASurface> surface;
-      image->GetFrame(imgIContainer::FRAME_CURRENT,
-                      imgIContainer::FLAG_SYNC_DECODE,
-                      getter_AddRefs(surface));
+      nsRefPtr<gfxASurface> surface =
+        image->GetFrame(imgIContainer::FRAME_CURRENT,
+                        imgIContainer::FLAG_SYNC_DECODE);
       if (!surface) {
         continue;
       }
diff --git a/widget/cocoa/nsCocoaUtils.mm b/widget/cocoa/nsCocoaUtils.mm
index daa877d430a7..def55acb5f19 100644
--- a/widget/cocoa/nsCocoaUtils.mm
+++ b/widget/cocoa/nsCocoaUtils.mm
@@ -372,10 +372,8 @@ nsresult nsCocoaUtils::CreateNSImageFromImageContainer(imgIContainer *aImage, ui
   }
 
   else {
-    nsRefPtr<gfxASurface> surface;
-    aImage->GetFrame(aWhichFrame,
-                     imgIContainer::FLAG_SYNC_DECODE,
-                     getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      aImage->GetFrame(aWhichFrame, imgIContainer::FLAG_SYNC_DECODE);
     NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
     frame = surface->GetAsReadableARGB32ImageSurface();
diff --git a/widget/cocoa/nsMenuItemIconX.mm b/widget/cocoa/nsMenuItemIconX.mm
index 2975155c0d1d..a31b0247e702 100644
--- a/widget/cocoa/nsMenuItemIconX.mm
+++ b/widget/cocoa/nsMenuItemIconX.mm
@@ -384,10 +384,9 @@ nsMenuItemIconX::OnStopFrame(imgIRequest*    aRequest)
     mImageRegionRect.SetRect(0, 0, origWidth, origHeight);
   }
   
-  nsRefPtr<gfxASurface> surface;
-  imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
-                           imgIContainer::FLAG_NONE,
-                           getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
+                             imgIContainer::FLAG_NONE);
   if (!surface) {
     [mNativeMenuItem setImage:nil];
     return NS_ERROR_FAILURE;
diff --git a/widget/gtk/nsImageToPixbuf.cpp b/widget/gtk/nsImageToPixbuf.cpp
index 35319b503c16..0acb7f787dc1 100644
--- a/widget/gtk/nsImageToPixbuf.cpp
+++ b/widget/gtk/nsImageToPixbuf.cpp
@@ -36,19 +36,17 @@ nsImageToPixbuf::ConvertImageToPixbuf(imgIContainer* aImage)
 GdkPixbuf*
 nsImageToPixbuf::ImageToPixbuf(imgIContainer* aImage)
 {
-    nsRefPtr<gfxASurface> surface;
-    aImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                     imgIContainer::FLAG_SYNC_DECODE,
-                     getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      aImage->GetFrame(imgIContainer::FRAME_CURRENT,
+                       imgIContainer::FLAG_SYNC_DECODE);
 
     // If the last call failed, it was probably because our call stack originates
     // in an imgINotificationObserver event, meaning that we're not allowed request
     // a sync decode. Presumably the originating event is something sensible like
     // OnStopFrame(), so we can just retry the call without a sync decode.
     if (!surface)
-        aImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                         imgIContainer::FLAG_NONE,
-                         getter_AddRefs(surface));
+        surface = aImage->GetFrame(imgIContainer::FRAME_CURRENT,
+                                   imgIContainer::FLAG_NONE);
 
     NS_ENSURE_TRUE(surface, nullptr);
 
diff --git a/widget/os2/nsWindow.cpp b/widget/os2/nsWindow.cpp
index a8245bd80deb..5c39f900f121 100644
--- a/widget/os2/nsWindow.cpp
+++ b/widget/os2/nsWindow.cpp
@@ -1334,10 +1334,9 @@ NS_IMETHODIMP nsWindow::SetCursor(imgIContainer* aCursor,
     return NS_OK;
   }
 
-  nsRefPtr<gfxASurface> surface;
-  aCursor->GetFrame(imgIContainer::FRAME_CURRENT,
-                    imgIContainer::FLAG_SYNC_DECODE,
-                    getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aCursor->GetFrame(imgIContainer::FRAME_CURRENT,
+                      imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_NOT_AVAILABLE);
 
   nsRefPtr<gfxImageSurface> frame(surface->GetAsReadableARGB32ImageSurface());
diff --git a/widget/qt/nsClipboard.cpp b/widget/qt/nsClipboard.cpp
index 6fe5fd1d8951..dfabcfaf17ba 100644
--- a/widget/qt/nsClipboard.cpp
+++ b/widget/qt/nsClipboard.cpp
@@ -176,10 +176,9 @@ nsClipboard::SetNativeClipboardData( nsITransferable *aTransferable,
                 if (!image)  // Not getting an image for an image mime type!?
                    continue;
 
-                nsRefPtr<gfxASurface> surface;
-                image->GetFrame(imgIContainer::FRAME_CURRENT,
-                                imgIContainer::FLAG_SYNC_DECODE,
-                                getter_AddRefs(surface));
+                nsRefPtr<gfxASurface> surface =
+                  image->GetFrame(imgIContainer::FRAME_CURRENT,
+                                  imgIContainer::FLAG_SYNC_DECODE);
                 if (!surface)
                   continue;
 
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 7a2aafaba080..0c41149f9376 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -694,8 +694,8 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
                                 getter_AddRefs(container));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsRefPtr<gfxASurface> imgFrame;
-  rv = container->GetFrame(imgIContainer::FRAME_FIRST, 0, getter_AddRefs(imgFrame));
+  nsRefPtr<gfxASurface> imgFrame =
+    container->GetFrame(imgIContainer::FRAME_FIRST, 0);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsRefPtr<gfxImageSurface> imageSurface;
diff --git a/widget/windows/nsImageClipboard.cpp b/widget/windows/nsImageClipboard.cpp
index 230692f5242c..58f5e300b8af 100644
--- a/widget/windows/nsImageClipboard.cpp
+++ b/widget/windows/nsImageClipboard.cpp
@@ -116,10 +116,9 @@ nsImageToClipboard::CreateFromImage ( imgIContainer* inImage, HANDLE* outBitmap
     nsresult rv;
     *outBitmap = nullptr;
 
-    nsRefPtr<gfxASurface> surface;
-    inImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                      imgIContainer::FLAG_SYNC_DECODE,
-                      getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      inImage->GetFrame(imgIContainer::FRAME_CURRENT,
+                        imgIContainer::FLAG_SYNC_DECODE);
     NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
     nsRefPtr<gfxImageSurface> frame(surface->GetAsReadableARGB32ImageSurface());
diff --git a/widget/windows/nsWindowGfx.cpp b/widget/windows/nsWindowGfx.cpp
index c34e87597135..e086bb613ad4 100644
--- a/widget/windows/nsWindowGfx.cpp
+++ b/widget/windows/nsWindowGfx.cpp
@@ -647,10 +647,9 @@ nsresult nsWindowGfx::CreateIcon(imgIContainer *aContainer,
                                   HICON *aIcon) {
 
   // Get the image data
-  nsRefPtr<gfxASurface> surface;
-  aContainer->GetFrame(imgIContainer::FRAME_CURRENT,
-                       imgIContainer::FLAG_SYNC_DECODE,
-                       getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aContainer->GetFrame(imgIContainer::FRAME_CURRENT,
+                         imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_NOT_AVAILABLE);
 
   nsRefPtr<gfxImageSurface> frame(surface->GetAsReadableARGB32ImageSurface());

From 27618ee0afd77fc4898e5a6918ce79dde9dab83f Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 08:40:57 +0000
Subject: [PATCH 028/144] Bug 944442 follow-up to check for null instead of rv
 error. r=me

---
 widget/windows/WinUtils.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 0c41149f9376..4457d57d0bba 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -696,7 +696,7 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
 
   nsRefPtr<gfxASurface> imgFrame =
     container->GetFrame(imgIContainer::FRAME_FIRST, 0);
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_TRUE(imgFrame, NS_ERROR_FAILURE);
 
   nsRefPtr<gfxImageSurface> imageSurface;
   gfxIntSize size;

From 790a58b7dd08ae0c8bb7f06ef24893de121efde4 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Wed, 4 Dec 2013 15:23:30 -0800
Subject: [PATCH 029/144] Bug 945250 - Evict the nursery before using CellIter;
 r=jonco

---
 js/public/GCAPI.h          |  3 +++
 js/src/gc/GCInternals.h    |  2 +-
 js/src/gc/Iteration.cpp    |  3 +++
 js/src/gc/Nursery.cpp      | 25 ++++++++++++++++---------
 js/src/gc/Nursery.h        |  8 ++++++++
 js/src/gc/Verifier.cpp     | 22 ++++++++++++++++------
 js/src/jit/BaselineJIT.cpp | 10 ++++++++++
 js/src/jscompartment.cpp   |  8 --------
 js/src/jsfriendapi.cpp     | 25 ++++++++++++++++++-------
 js/src/jsgc.cpp            | 10 +++++++++-
 js/src/jsgcinlines.h       | 14 ++++++++++++++
 js/src/jsobjinlines.h      |  5 ++++-
 js/src/vm/Runtime.cpp      |  2 +-
 js/src/vm/Runtime.h        |  2 +-
 js/src/vm/Shape.cpp        |  3 +++
 15 files changed, 107 insertions(+), 35 deletions(-)

diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index b37740838a9d..b48106041caa 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -187,6 +187,9 @@ DisableGenerationalGC(JSRuntime *rt);
 extern JS_FRIEND_API(void)
 EnableGenerationalGC(JSRuntime *rt);
 
+extern JS_FRIEND_API(bool)
+IsGenerationalGCEnabled(JSRuntime *rt);
+
 extern JS_FRIEND_API(bool)
 IsIncrementalBarrierNeeded(JSRuntime *rt);
 
diff --git a/js/src/gc/GCInternals.h b/js/src/gc/GCInternals.h
index d675a47c4b46..2acd4fe379bb 100644
--- a/js/src/gc/GCInternals.h
+++ b/js/src/gc/GCInternals.h
@@ -130,7 +130,7 @@ class AutoStopVerifyingBarriers
       : runtime(rt)
     {
         restartPreVerifier = !isShutdown && rt->gcVerifyPreData;
-        restartPostVerifier = !isShutdown && rt->gcVerifyPostData && rt->gcGenerationalEnabled;
+        restartPostVerifier = !isShutdown && rt->gcVerifyPostData && JS::IsGenerationalGCEnabled(rt);
         if (rt->gcVerifyPreData)
             EndVerifyPreBarriers(rt);
         if (rt->gcVerifyPostData)
diff --git a/js/src/gc/Iteration.cpp b/js/src/gc/Iteration.cpp
index 94dbbe998d5d..6b692b55f9db 100644
--- a/js/src/gc/Iteration.cpp
+++ b/js/src/gc/Iteration.cpp
@@ -22,6 +22,7 @@ js::TraceRuntime(JSTracer *trc)
 {
     JS_ASSERT(!IS_GC_MARKING_TRACER(trc));
 
+    MinorGC(trc->runtime, JS::gcreason::EVICT_NURSERY);
     AutoPrepareForTracing prep(trc->runtime, WithAtoms);
     MarkRuntime(trc);
 }
@@ -91,6 +92,7 @@ void
 js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
                    void *data, IterateScriptCallback scriptCallback)
 {
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
     AutoPrepareForTracing prep(rt, SkipAtoms);
 
     if (compartment) {
@@ -110,6 +112,7 @@ js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
 void
 js::IterateGrayObjects(Zone *zone, GCThingCallback cellCallback, void *data)
 {
+    MinorGC(zone->runtimeFromMainThread(), JS::gcreason::EVICT_NURSERY);
     AutoPrepareForTracing prep(zone->runtimeFromMainThread(), SkipAtoms);
 
     for (size_t finalizeKind = 0; finalizeKind <= FINALIZE_OBJECT_LAST; finalizeKind++) {
diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index 08924deaa8e1..71d38094b102 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -75,9 +75,9 @@ js::Nursery::~Nursery()
 void
 js::Nursery::enable()
 {
+    JS_ASSERT(isEmpty());
     if (isEnabled())
         return;
-    JS_ASSERT_IF(runtime()->gcZeal_ != ZealGenerationalGCValue, position_ == start());
     numActiveChunks_ = 1;
     setCurrentChunk(0);
 #ifdef JS_GC_ZEAL
@@ -91,11 +91,19 @@ js::Nursery::disable()
 {
     if (!isEnabled())
         return;
-    JS_ASSERT_IF(runtime()->gcZeal_ != ZealGenerationalGCValue, position_ == start());
+    JS_ASSERT(isEmpty());
     numActiveChunks_ = 0;
     currentEnd_ = 0;
 }
 
+bool
+js::Nursery::isEmpty() const
+{
+    JS_ASSERT(runtime_);
+    JS_ASSERT_IF(runtime_->gcZeal_ != ZealGenerationalGCValue, currentStart_ == start());
+    return !isEnabled() || position() == currentStart_;
+}
+
 void *
 js::Nursery::allocate(size_t size)
 {
@@ -355,8 +363,6 @@ js::Nursery::forwardBufferPointer(HeapSlot **pSlotsElems)
     JS_ASSERT(!isInside(*pSlotsElems));
 }
 
-namespace {
-
 // Structure for counting how many times objects of a particular type have been
 // tenured during a minor collection.
 struct TenureCount
@@ -365,8 +371,6 @@ struct TenureCount
     int count;
 };
 
-} // anonymous namespace
-
 // Keep rough track of how many times we tenure objects of particular types
 // during minor collections, using a fixed size hash for efficiency at the cost
 // of potential collisions.
@@ -598,11 +602,11 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason, TypeObjectList
     if (!isEnabled())
         return;
 
-    AutoStopVerifyingBarriers av(rt, false);
-
-    if (position() == start())
+    if (isEmpty())
         return;
 
+    AutoStopVerifyingBarriers av(rt, false);
+
     rt->gcHelperThread.waitBackgroundSweepEnd();
 
     /* Move objects pointed to by roots from the nursery to the major heap. */
@@ -679,6 +683,9 @@ js::Nursery::sweep(JSRuntime *rt)
         if (currentChunk_ + 1 == NumNurseryChunks)
             setCurrentChunk(0);
 
+        /* Set current start position for isEmpty checks. */
+        currentStart_ = position();
+
         return;
     }
 #endif
diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
index 55680cd1adbd..a2a30bd0b91e 100644
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -57,6 +57,7 @@ class Nursery
     explicit Nursery(JSRuntime *rt)
       : runtime_(rt),
         position_(0),
+        currentStart_(0),
         currentEnd_(0),
         currentChunk_(0),
         numActiveChunks_(0)
@@ -69,6 +70,9 @@ class Nursery
     void disable();
     bool isEnabled() const { return numActiveChunks_ != 0; }
 
+    /* Return true if no allocations have been made since the last collection. */
+    bool isEmpty() const;
+
     template <typename T>
     JS_ALWAYS_INLINE bool isInside(const T *p) const {
         return gc::IsInsideNursery((JS::shadow::Runtime *)runtime_, p);
@@ -144,6 +148,9 @@ class Nursery
     /* Pointer to the first unallocated byte in the nursery. */
     uintptr_t position_;
 
+    /* Pointer to the logic start of the Nursery. */
+    uintptr_t currentStart_;
+
     /* Pointer to the last byte of space in the current chunk. */
     uintptr_t currentEnd_;
 
@@ -196,6 +203,7 @@ class Nursery
         JS_ASSERT(chunkno < numActiveChunks_);
         currentChunk_ = chunkno;
         position_ = chunk(chunkno).start();
+        currentStart_ = chunk(0).start();
         currentEnd_ = chunk(chunkno).end();
     }
 
diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 1d0bd8281dd9..6e7732e507d4 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -14,6 +14,7 @@
 
 #include "gc/GCInternals.h"
 #include "gc/Zone.h"
+#include "js/GCAPI.h"
 #include "js/HashTable.h"
 
 #include "jscntxtinlines.h"
@@ -365,7 +366,8 @@ typedef HashMap<void *, VerifyNode *, DefaultHasher<void *>, SystemAllocPolicy>
  * The nodemap field is a hashtable that maps from the address of the GC thing
  * to the VerifyNode that represents it.
  */
-struct VerifyPreTracer : JSTracer {
+struct VerifyPreTracer : JSTracer
+{
     /* The gcNumber when the verification began. */
     uint64_t number;
 
@@ -379,8 +381,14 @@ struct VerifyPreTracer : JSTracer {
     char *term;
     NodeMap nodemap;
 
-    VerifyPreTracer() : root(nullptr) {}
-    ~VerifyPreTracer() { js_free(root); }
+    VerifyPreTracer(JSRuntime *rt) : root(nullptr) {
+        JS::DisableGenerationalGC(rt);
+    }
+
+    ~VerifyPreTracer() {
+        js_free(root);
+        JS::EnableGenerationalGC(runtime);
+    }
 };
 
 /*
@@ -446,7 +454,7 @@ gc::StartVerifyPreBarriers(JSRuntime *rt)
     if (rt->gcVerifyPreData || rt->gcIncrementalState != NO_INCREMENTAL)
         return;
 
-    MinorGC(rt, JS::gcreason::API);
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
 
     AutoPrepareForTracing prep(rt, WithAtoms);
 
@@ -456,7 +464,7 @@ gc::StartVerifyPreBarriers(JSRuntime *rt)
     for (GCChunkSet::Range r(rt->gcChunkSet.all()); !r.empty(); r.popFront())
         r.front()->bitmap.clear();
 
-    VerifyPreTracer *trc = js_new<VerifyPreTracer>();
+    VerifyPreTracer *trc = js_new<VerifyPreTracer>(rt);
     if (!trc)
         return;
 
@@ -576,6 +584,8 @@ AssertMarkedOrAllocated(const EdgeValue &edge)
 void
 gc::EndVerifyPreBarriers(JSRuntime *rt)
 {
+    JS_ASSERT(!JS::IsGenerationalGCEnabled(rt));
+
     AutoPrepareForTracing prep(rt, SkipAtoms);
 
     VerifyPreTracer *trc = (VerifyPreTracer *)rt->gcVerifyPreData;
@@ -658,7 +668,7 @@ gc::StartVerifyPostBarriers(JSRuntime *rt)
         return;
     }
 
-    MinorGC(rt, JS::gcreason::API);
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
 
     VerifyPostTracer *trc = js_new<VerifyPostTracer>();
     if (!trc)
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 0956e75f4ca6..36e2867a888a 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -443,6 +443,16 @@ BaselineScript::Trace(JSTracer *trc, BaselineScript *script)
 void
 BaselineScript::Destroy(FreeOp *fop, BaselineScript *script)
 {
+#ifdef JSGC_GENERATIONAL
+    /*
+     * When the script contains pointers to nursery things, the store buffer
+     * will contain entries refering to the referenced things. Since we can
+     * destroy scripts outside the context of a GC, this situation can result
+     * in invalid store buffer entries. Assert that if we do destroy scripts
+     * outside of a GC that we at least emptied the nursery first.
+     */
+    JS_ASSERT(fop->runtime()->gcNursery.isEmpty());
+#endif
     fop->delete_(script);
 }
 
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index a4132018c96f..2d1fbff3ca19 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -634,14 +634,6 @@ JSCompartment::setObjectMetadataCallback(js::ObjectMetadataCallback callback)
     // whether there is a creation callback.
     ReleaseAllJITCode(runtime_->defaultFreeOp());
 
-    // Turn off GGC while the metadata hook is present, to prevent
-    // nursery-allocated metadata from being used as a lookup key in
-    // InitialShapeTable entries.
-    if (callback)
-        JS::DisableGenerationalGC(runtime_);
-    else
-        JS::EnableGenerationalGC(runtime_);
-
     objectMetadataCallback = callback;
 }
 
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 5e2806f42612..e62b9dec3781 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -933,24 +933,35 @@ JS::DisableIncrementalGC(JSRuntime *rt)
 extern JS_FRIEND_API(void)
 JS::DisableGenerationalGC(JSRuntime *rt)
 {
-    rt->gcGenerationalEnabled = false;
 #ifdef JSGC_GENERATIONAL
-    MinorGC(rt, JS::gcreason::API);
-    rt->gcNursery.disable();
-    rt->gcStoreBuffer.disable();
+    if (IsGenerationalGCEnabled(rt)) {
+        MinorGC(rt, JS::gcreason::API);
+        rt->gcNursery.disable();
+        rt->gcStoreBuffer.disable();
+    }
 #endif
+    ++rt->gcGenerationalDisabled;
 }
 
 extern JS_FRIEND_API(void)
 JS::EnableGenerationalGC(JSRuntime *rt)
 {
-    rt->gcGenerationalEnabled = true;
+    JS_ASSERT(rt->gcGenerationalDisabled > 0);
+    --rt->gcGenerationalDisabled;
 #ifdef JSGC_GENERATIONAL
-    rt->gcNursery.enable();
-    rt->gcStoreBuffer.enable();
+    if (IsGenerationalGCEnabled(rt)) {
+        rt->gcNursery.enable();
+        rt->gcStoreBuffer.enable();
+    }
 #endif
 }
 
+extern JS_FRIEND_API(bool)
+JS::IsGenerationalGCEnabled(JSRuntime *rt)
+{
+    return rt->gcGenerationalDisabled == 0;
+}
+
 JS_FRIEND_API(bool)
 JS::IsIncrementalBarrierNeeded(JSRuntime *rt)
 {
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index dd3cde985825..b2e65166aea5 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -5267,8 +5267,16 @@ void
 js::ReleaseAllJITCode(FreeOp *fop)
 {
 #ifdef JS_ION
-    for (ZonesIter zone(fop->runtime(), SkipAtoms); !zone.done(); zone.next()) {
 
+# ifdef JSGC_GENERATIONAL
+    /*
+     * Scripts can entrain nursery things, inserting references to the script
+     * into the store buffer. Clear the store buffer before discarding scripts.
+     */
+    MinorGC(fop->runtime(), JS::gcreason::EVICT_NURSERY);
+# endif
+
+    for (ZonesIter zone(fop->runtime(), SkipAtoms); !zone.done(); zone.next()) {
 # ifdef DEBUG
         /* Assert no baseline scripts are marked as active. */
         for (CellIter i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index 46c0c81d75f2..c162df0b8946 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -244,6 +244,9 @@ class CellIterUnderGC : public CellIterImpl
 {
   public:
     CellIterUnderGC(JS::Zone *zone, AllocKind kind) {
+#ifdef JSGC_GENERATIONAL
+        JS_ASSERT(zone->runtimeFromAnyThread()->gcNursery.isEmpty());
+#endif
         JS_ASSERT(zone->runtimeFromAnyThread()->isHeapBusy());
         init(zone, kind);
     }
@@ -277,16 +280,27 @@ class CellIter : public CellIterImpl
         {
             gc::FinishBackgroundFinalize(zone->runtimeFromMainThread());
         }
+
+#ifdef JSGC_GENERATIONAL
+        /* Evict the nursery before iterating so we can see all things. */
+        JSRuntime *rt = zone->runtimeFromMainThread();
+        if (!rt->gcNursery.isEmpty())
+            MinorGC(rt, JS::gcreason::EVICT_NURSERY);
+#endif
+
         if (lists->isSynchronizedFreeList(kind)) {
             lists = nullptr;
         } else {
             JS_ASSERT(!zone->runtimeFromMainThread()->isHeapBusy());
             lists->copyFreeListToArena(kind);
         }
+
 #ifdef DEBUG
+        /* Assert that no GCs can occur while a CellIter is live. */
         counter = &zone->runtimeFromAnyThread()->noGCOrAllocationCheck;
         ++*counter;
 #endif
+
         init(zone, kind);
     }
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 4bda696f6ac1..5704017a5eb4 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1019,8 +1019,11 @@ NewObjectMetadata(ExclusiveContext *cxArg, JSObject **pmetadata)
             !cx->compartment()->activeAnalysis &&
             !cx->runtime()->mainThread.activeCompilations)
         {
+            JS::DisableGenerationalGC(cx->runtime());
             gc::AutoSuppressGC suppress(cx);
-            return cx->compartment()->callObjectMetadataCallback(cx, pmetadata);
+            bool status = cx->compartment()->callObjectMetadataCallback(cx, pmetadata);
+            JS::EnableGenerationalGC(cx->runtime());
+            return status;
         }
     }
     return true;
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index d9e57b8cfb26..169921adeee0 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -219,7 +219,7 @@ JSRuntime::JSRuntime(JSUseHelperThreads useHelperThreads)
     gcInterFrameGC(0),
     gcSliceBudget(SliceBudget::Unlimited),
     gcIncrementalEnabled(true),
-    gcGenerationalEnabled(true),
+    gcGenerationalDisabled(0),
     gcManipulatingDeadZones(false),
     gcObjectsMarkedInDeadZones(0),
     gcPoke(false),
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index e60ed6f0b220..0667445320bf 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -1153,7 +1153,7 @@ struct JSRuntime : public JS::shadow::Runtime,
     /*
      * GGC can be enabled from the command line while testing.
      */
-    bool                gcGenerationalEnabled;
+    unsigned            gcGenerationalDisabled;
 
     /*
      * This is true if we are in the middle of a brain transplant (e.g.,
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index 8fb1d34a2a11..f95670834921 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1588,6 +1588,9 @@ EmptyShape::getInitialShape(ExclusiveContext *cx, const Class *clasp, TaggedProt
 {
     JS_ASSERT_IF(proto.isObject(), cx->isInsideCurrentCompartment(proto.toObject()));
     JS_ASSERT_IF(parent, cx->isInsideCurrentCompartment(parent));
+#ifdef JSGC_GENERATIONAL
+    JS_ASSERT_IF(metadata && cx->hasNursery(), !cx->nursery().isInside(metadata));
+#endif
 
     InitialShapeSet &table = cx->compartment()->initialShapes;
 

From bc744f6bf13d3f8c8487f6d692632fb238a77ccd Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Fri, 13 Dec 2013 09:32:19 +0000
Subject: [PATCH 030/144] Bug 945285 - Don't verify post barriers if store
 buffer is disabled r=sfink

---
 js/src/gc/Verifier.cpp                 | 4 +++-
 js/src/jit-test/tests/gc/bug-945285.js | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-945285.js

diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 6e7732e507d4..9cd3710e57e5 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -830,10 +830,11 @@ MaybeVerifyPreBarriers(JSRuntime *rt, bool always)
 static void
 MaybeVerifyPostBarriers(JSRuntime *rt, bool always)
 {
+#ifdef JSGC_GENERATIONAL
     if (rt->gcZeal() != ZealVerifierPostValue)
         return;
 
-    if (rt->mainThread.suppressGC)
+    if (rt->mainThread.suppressGC || !rt->gcStoreBuffer.isEnabled())
         return;
 
     if (VerifyPostTracer *trc = (VerifyPostTracer *)rt->gcVerifyPostData) {
@@ -843,6 +844,7 @@ MaybeVerifyPostBarriers(JSRuntime *rt, bool always)
         EndVerifyPostBarriers(rt);
     }
     StartVerifyPostBarriers(rt);
+#endif
 }
 
 void
diff --git a/js/src/jit-test/tests/gc/bug-945285.js b/js/src/jit-test/tests/gc/bug-945285.js
new file mode 100644
index 000000000000..c2d83d215f82
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-945285.js
@@ -0,0 +1,3 @@
+gczeal(11);
+function callback(obj) {}
+setObjectMetadataCallback(callback);

From 0fa113316c1441697e58148e2c52d547a984bd0b Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Fri, 13 Dec 2013 09:32:19 +0000
Subject: [PATCH 031/144] Bug 945280 - Reset nursery to initial state on
 disabling generational GC zeal mode r=terrence

---
 js/src/gc/Nursery.h                    |  6 ++++++
 js/src/jit-test/tests/gc/bug-945280.js |  4 ++++
 js/src/jsgc.cpp                        | 23 +++++++++++++----------
 3 files changed, 23 insertions(+), 10 deletions(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-945280.js

diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
index a2a30bd0b91e..524ba30c1fc0 100644
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -135,6 +135,12 @@ class Nursery
         if (isEnabled())
             numActiveChunks_ = NumNurseryChunks;
     }
+    void leaveZealMode() {
+        if (isEnabled()) {
+            JS_ASSERT(isEmpty());
+            setCurrentChunk(0);
+        }
+    }
 #endif
 
   private:
diff --git a/js/src/jit-test/tests/gc/bug-945280.js b/js/src/jit-test/tests/gc/bug-945280.js
new file mode 100644
index 000000000000..48b9695d8ed4
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-945280.js
@@ -0,0 +1,4 @@
+gczeal(7,1);
+setObjectMetadataCallback(setObjectMetadataCallback);
+gczeal(false);
+var statusitems = [];
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index b2e65166aea5..909dff6c5c63 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1014,22 +1014,25 @@ PickChunk(Zone *zone)
 extern void
 js::SetGCZeal(JSRuntime *rt, uint8_t zeal, uint32_t frequency)
 {
-    if (zeal == 0) {
-        if (rt->gcVerifyPreData)
-            VerifyBarriers(rt, PreBarrierVerifier);
-        if (rt->gcVerifyPostData)
-            VerifyBarriers(rt, PostBarrierVerifier);
+    if (rt->gcVerifyPreData)
+        VerifyBarriers(rt, PreBarrierVerifier);
+    if (rt->gcVerifyPostData)
+        VerifyBarriers(rt, PostBarrierVerifier);
+
+#ifdef JSGC_GENERATIONAL
+    if (rt->gcZeal_ == ZealGenerationalGCValue) {
+        MinorGC(rt, JS::gcreason::DEBUG_GC);
+        rt->gcNursery.leaveZealMode();
     }
 
+    if (zeal == ZealGenerationalGCValue)
+        rt->gcNursery.enterZealMode();
+#endif
+
     bool schedule = zeal >= js::gc::ZealAllocValue;
     rt->gcZeal_ = zeal;
     rt->gcZealFrequency = frequency;
     rt->gcNextScheduled = schedule ? frequency : 0;
-
-#ifdef JSGC_GENERATIONAL
-    if (zeal == ZealGenerationalGCValue)
-        rt->gcNursery.enterZealMode();
-#endif
 }
 
 static bool

From cd447e7fa50fcc0b22f17c508cb7af2518748e56 Mon Sep 17 00:00:00 2001
From: Simon Montagu <smontagu@smontagu.org>
Date: Fri, 13 Dec 2013 12:09:26 +0200
Subject: [PATCH 032/144] Add NS_FRAME_IS_BIDI bit even when short-circuiting
 bidi resolution. Bug 942690, r=roc

---
 layout/base/crashtests/942690.html     | 15 +++++++++++++++
 layout/base/crashtests/crashtests.list |  1 +
 layout/base/nsBidiPresUtils.cpp        |  1 +
 3 files changed, 17 insertions(+)
 create mode 100644 layout/base/crashtests/942690.html

diff --git a/layout/base/crashtests/942690.html b/layout/base/crashtests/942690.html
new file mode 100644
index 000000000000..da64dd00dc97
--- /dev/null
+++ b/layout/base/crashtests/942690.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+    <title>14 Rendering — HTML Standard</title>
+    <style>
+      pre.css:first-line { color: #AAAA50; }
+    </style>
+      </head>
+<body>
+  <pre class="css">foo
+
+bar ׳
+</pre>  
+</body></html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index c79e526dd48f..9dc19257ec07 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -422,3 +422,4 @@ load 931464.html
 load 936988-1.html
 load 931460-1.html
 load 935765-1.html
+load 942690.html
diff --git a/layout/base/nsBidiPresUtils.cpp b/layout/base/nsBidiPresUtils.cpp
index 5ec7c469d9d2..6c223c742fc4 100644
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -687,6 +687,7 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame,
       printf("early return for single direction frame %p\n", (void*)frame);
 #endif
 #endif
+      frame->AddStateBits(NS_FRAME_IS_BIDI);
       return NS_OK;
     }
   }

From bb725d63df84bd72e71455940eea49f5d247c24a Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Fri, 13 Dec 2013 13:17:33 +0200
Subject: [PATCH 033/144] Bug 949968 - Intermittent TEST-UNEXPECTED-FAIL |
 chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
 | Test timed out, r=me

---
 .../test/browser_dbg_variables-view-override-02.js        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js b/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
index d515359c41d1..f9da58be6877 100644
--- a/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
@@ -14,13 +14,13 @@ function test() {
     let events = win.EVENTS;
     let variables = win.DebuggerView.Variables;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.test());
-    yield waitForSourceAndCaretAndScopes(panel, ".html", 23);
-
     // Wait for the hierarchy to be committed by the VariablesViewController.
     let committed = promise.defer();
     variables.oncommit = committed.resolve;
+
+    // Allow this generator function to yield first.
+    executeSoon(() => debuggee.test());
+    yield waitForSourceAndCaretAndScopes(panel, ".html", 23);
     yield committed.promise;
 
     let firstScope = variables.getScopeAtIndex(0);

From 27f0f88f2992bb62e23dc9af2fca8f30de95469b Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Fri, 13 Dec 2013 12:46:03 +0100
Subject: [PATCH 034/144] Backed out changeset 273e7ed05fa3 (bug 949304) for
 Windows Bustage on a CLOSED TREE

---
 .../mozbuild/backend/recursivemake.py         | 21 +++++--------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index a909efff8ee4..c9a4000dd46a 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -268,25 +268,17 @@ class RecursiveMakeBackend(CommonBackend):
         self._ipdl_sources = set()
 
         def detailed(summary):
-            s = '{:d} total backend files; ' \
-                '{:d} created; {:d} updated; {:d} unchanged; ' \
-                '{:d} deleted; {:d} -> {:d} Makefile'.format(
+            s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
                 summary.created_count + summary.updated_count +
-                summary.unchanged_count,
-                summary.created_count,
-                summary.updated_count,
-                summary.unchanged_count,
-                summary.deleted_count,
-                summary.makefile_in_count,
-                summary.makefile_out_count)
-
+                summary.unchanged_count, summary.created_count,
+                summary.updated_count, summary.unchanged_count)
+            if summary.deleted_count:
+                s+= '; {:d} deleted'.format(summary.deleted_count)
             return s
 
         # This is a little kludgy and could be improved with a better API.
         self.summary.backend_detailed_summary = types.MethodType(detailed,
             self.summary)
-        self.summary.makefile_in_count = 0
-        self.summary.makefile_out_count = 0
 
         self._test_manifests = {}
 
@@ -672,7 +664,6 @@ class RecursiveMakeBackend(CommonBackend):
                 if not stub:
                     self.log(logging.DEBUG, 'substitute_makefile',
                         {'path': makefile}, 'Substituting makefile: {path}')
-                    self.summary.makefile_in_count += 1
 
                     for tier, skiplist in self._may_skip.items():
                         if tier in ('compile', 'binaries'):
@@ -1113,8 +1104,6 @@ class RecursiveMakeBackend(CommonBackend):
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
 
-        self.summary.makefile_out_count += 1
-
     def _handle_webidl_collection(self, webidls):
         if not webidls.all_stems():
             return

From dcf3207d311b948d6f45025757873065caeee20e Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Fri, 13 Dec 2013 12:46:22 +0100
Subject: [PATCH 035/144] Backed out changeset 203e2bcc575d (bug 949875) for
 Windows Bustage on a CLOSED TREE

---
 dom/bindings/mozwebidlcodegen/__init__.py | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index cbd6312b23d4..5516dbb3a1a0 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -24,8 +24,14 @@ from mozbuild.util import FileAvoidWrite
 
 import mozpack.path as mozpath
 
-# There are various imports in this file in functions to avoid adding
-# dependencies to config.status. See bug 949875.
+import WebIDL
+from Codegen import (
+    CGBindingRoot,
+    CGEventRoot,
+    CGExampleRoot,
+    GlobalGenRoots,
+)
+from Configuration import Configuration
 
 
 class BuildResult(object):
@@ -299,16 +305,11 @@ class WebIDLCodegenManager(LoggingMixin):
 
     def generate_example_files(self, interface):
         """Generates example files for a given interface."""
-        from Codegen import CGExampleRoot
-
         root = CGExampleRoot(self.config, interface)
 
         return self._maybe_write_codegen(root, *self._example_paths(interface))
 
     def _parse_webidl(self):
-        import WebIDL
-        from Configuration import Configuration
-
         self.log(logging.INFO, 'webidl_parse',
             {'count': len(self._input_paths)},
             'Parsing {count} WebIDL files.')
@@ -327,8 +328,6 @@ class WebIDLCodegenManager(LoggingMixin):
         self._input_hashes = hashes
 
     def _write_global_derived(self):
-        from Codegen import GlobalGenRoots
-
         things = [('declare', f) for f in self.GLOBAL_DECLARE_FILES]
         things.extend(('define', f) for f in self.GLOBAL_DEFINE_FILES)
 
@@ -454,11 +453,6 @@ class WebIDLCodegenManager(LoggingMixin):
         return paths
 
     def _generate_build_files_for_webidl(self, filename):
-        from Codegen import (
-            CGBindingRoot,
-            CGEventRoot,
-        )
-
         self.log(logging.INFO, 'webidl_generate_build_for_input',
             {'filename': filename},
             'Generating WebIDL files derived from {filename}')

From 8167b5ca6f52a3c4ecb213a42bd7ed7fceb79edb Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 00:03:55 +0900
Subject: [PATCH 036/144] Bug 949304 - Print Makefile counts during
 config.status; r=glandium

We now capture and print the number of Makefile.in and the number of
generated Makefile as part of config.status. This should give us a nice,
easy to extract metric going forward.

Pushing on a CLOSED TREE because this patch didn't deserve to get backed
out.

--HG--
extra : amend_source : 36028b17fd09c57455aef681bbe459891f5ed607
---
 .../mozbuild/backend/recursivemake.py         | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index c9a4000dd46a..a909efff8ee4 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -268,17 +268,25 @@ class RecursiveMakeBackend(CommonBackend):
         self._ipdl_sources = set()
 
         def detailed(summary):
-            s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
+            s = '{:d} total backend files; ' \
+                '{:d} created; {:d} updated; {:d} unchanged; ' \
+                '{:d} deleted; {:d} -> {:d} Makefile'.format(
                 summary.created_count + summary.updated_count +
-                summary.unchanged_count, summary.created_count,
-                summary.updated_count, summary.unchanged_count)
-            if summary.deleted_count:
-                s+= '; {:d} deleted'.format(summary.deleted_count)
+                summary.unchanged_count,
+                summary.created_count,
+                summary.updated_count,
+                summary.unchanged_count,
+                summary.deleted_count,
+                summary.makefile_in_count,
+                summary.makefile_out_count)
+
             return s
 
         # This is a little kludgy and could be improved with a better API.
         self.summary.backend_detailed_summary = types.MethodType(detailed,
             self.summary)
+        self.summary.makefile_in_count = 0
+        self.summary.makefile_out_count = 0
 
         self._test_manifests = {}
 
@@ -664,6 +672,7 @@ class RecursiveMakeBackend(CommonBackend):
                 if not stub:
                     self.log(logging.DEBUG, 'substitute_makefile',
                         {'path': makefile}, 'Substituting makefile: {path}')
+                    self.summary.makefile_in_count += 1
 
                     for tier, skiplist in self._may_skip.items():
                         if tier in ('compile', 'binaries'):
@@ -1104,6 +1113,8 @@ class RecursiveMakeBackend(CommonBackend):
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
 
+        self.summary.makefile_out_count += 1
+
     def _handle_webidl_collection(self, webidls):
         if not webidls.all_stems():
             return

From f47e1b29895d17dbc4ef2e6aa53967c9d3ad385c Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 12:14:36 +0000
Subject: [PATCH 037/144] Bug 944704, part 1 - Extend Moz2D's ArcToBezier
 helper so that it can draw ellipse arcs in addition to circle arcs. r=Bas

---
 gfx/2d/Path.cpp      |  2 +-
 gfx/2d/PathCairo.cpp |  2 +-
 gfx/2d/PathHelpers.h | 24 +++++++++++++-----------
 gfx/2d/PathSkia.cpp  |  2 +-
 4 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/gfx/2d/Path.cpp b/gfx/2d/Path.cpp
index 1bf3563313d5..c3902e816d94 100644
--- a/gfx/2d/Path.cpp
+++ b/gfx/2d/Path.cpp
@@ -121,7 +121,7 @@ void
 FlattenedPath::Arc(const Point &aOrigin, float aRadius, float aStartAngle,
                    float aEndAngle, bool aAntiClockwise)
 {
-  ArcToBezier(this, aOrigin, aRadius, aStartAngle, aEndAngle, aAntiClockwise);
+  ArcToBezier(this, aOrigin, Size(aRadius, aRadius), aStartAngle, aEndAngle, aAntiClockwise);
 }
 
 Float
diff --git a/gfx/2d/PathCairo.cpp b/gfx/2d/PathCairo.cpp
index 63836f0bb4e5..e94b44c76e05 100644
--- a/gfx/2d/PathCairo.cpp
+++ b/gfx/2d/PathCairo.cpp
@@ -113,7 +113,7 @@ void
 PathBuilderCairo::Arc(const Point &aOrigin, float aRadius, float aStartAngle,
                      float aEndAngle, bool aAntiClockwise)
 {
-  ArcToBezier(this, aOrigin, aRadius, aStartAngle, aEndAngle, aAntiClockwise);
+  ArcToBezier(this, aOrigin, Size(aRadius, aRadius), aStartAngle, aEndAngle, aAntiClockwise);
 }
 
 Point
diff --git a/gfx/2d/PathHelpers.h b/gfx/2d/PathHelpers.h
index eb8c9df43e55..7d3ef446e390 100644
--- a/gfx/2d/PathHelpers.h
+++ b/gfx/2d/PathHelpers.h
@@ -13,11 +13,11 @@ namespace mozilla {
 namespace gfx {
 
 template <typename T>
-void ArcToBezier(T* aSink, const Point &aOrigin, float aRadius, float aStartAngle,
-                 float aEndAngle, bool aAntiClockwise)
+void ArcToBezier(T* aSink, const Point &aOrigin, const Size &aRadius,
+                 float aStartAngle, float aEndAngle, bool aAntiClockwise)
 {
-  Point startPoint(aOrigin.x + cos(aStartAngle) * aRadius,
-                   aOrigin.y + sin(aStartAngle) * aRadius);
+  Point startPoint(aOrigin.x + cos(aStartAngle) * aRadius.width,
+                   aOrigin.y + sin(aStartAngle) * aRadius.height);
 
   aSink->LineTo(startPoint);
 
@@ -56,23 +56,25 @@ void ArcToBezier(T* aSink, const Point &aOrigin, float aRadius, float aStartAngl
       currentEndAngle = currentStartAngle + arcSweepLeft * sweepDirection;
     }
 
-    Point currentStartPoint(aOrigin.x + cos(currentStartAngle) * aRadius,
-                            aOrigin.y + sin(currentStartAngle) * aRadius);
-    Point currentEndPoint(aOrigin.x + cos(currentEndAngle) * aRadius,
-                          aOrigin.y + sin(currentEndAngle) * aRadius);
+    Point currentStartPoint(aOrigin.x + cos(currentStartAngle) * aRadius.width,
+                            aOrigin.y + sin(currentStartAngle) * aRadius.height);
+    Point currentEndPoint(aOrigin.x + cos(currentEndAngle) * aRadius.width,
+                          aOrigin.y + sin(currentEndAngle) * aRadius.height);
 
     // Calculate kappa constant for partial curve. The sign of angle in the
     // tangent will actually ensure this is negative for a counter clockwise
     // sweep, so changing signs later isn't needed.
-    Float kappa = (4.0f / 3.0f) * tan((currentEndAngle - currentStartAngle) / 4.0f) * aRadius;
+    Float kappaFactor = (4.0f / 3.0f) * tan((currentEndAngle - currentStartAngle) / 4.0f);
+    Float kappaX = kappaFactor * aRadius.width;
+    Float kappaY = kappaFactor * aRadius.height;
 
     Point tangentStart(-sin(currentStartAngle), cos(currentStartAngle));
     Point cp1 = currentStartPoint;
-    cp1 += tangentStart * kappa;
+    cp1 += Point(tangentStart.x * kappaX, tangentStart.y * kappaY);
 
     Point revTangentEnd(sin(currentEndAngle), -cos(currentEndAngle));
     Point cp2 = currentEndPoint;
-    cp2 += revTangentEnd * kappa;
+    cp2 += Point(revTangentEnd.x * kappaX, revTangentEnd.y * kappaY);
 
     aSink->BezierTo(cp1, cp2, currentEndPoint);
 
diff --git a/gfx/2d/PathSkia.cpp b/gfx/2d/PathSkia.cpp
index a28d96e47268..95c0e6b29664 100644
--- a/gfx/2d/PathSkia.cpp
+++ b/gfx/2d/PathSkia.cpp
@@ -88,7 +88,7 @@ void
 PathBuilderSkia::Arc(const Point &aOrigin, float aRadius, float aStartAngle,
                      float aEndAngle, bool aAntiClockwise)
 {
-  ArcToBezier(this, aOrigin, aRadius, aStartAngle, aEndAngle, aAntiClockwise);
+  ArcToBezier(this, aOrigin, Size(aRadius, aRadius), aStartAngle, aEndAngle, aAntiClockwise);
 }
 
 Point

From 911790747368ddc7ee2ffc13a964d5983769322a Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 12:14:36 +0000
Subject: [PATCH 038/144] Bug 944704, part 2 - Update the Mozilla callers of
 Moz2D's ArcToBezier for its new signature. r=Bas

---
 content/canvas/src/CanvasRenderingContext2D.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 02c6f453031d..74b9992e4b39 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1890,7 +1890,7 @@ CanvasRenderingContext2D::Arc(double x, double y, double r,
 
   EnsureWritablePath();
 
-  ArcToBezier(this, Point(x, y), r, startAngle, endAngle, anticlockwise);
+  ArcToBezier(this, Point(x, y), Size(r, r), startAngle, endAngle, anticlockwise);
 }
 
 void

From 609fb5fc12993e93e49dfcd1a318b6702d8ee75a Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 12:14:37 +0000
Subject: [PATCH 039/144] Bug 944704, part 3 - Fix stroke dashing for SVG
 ellipses so that the dashing starts from the correct point and progresses in
 the correct direction. r=Bas

---
 content/svg/content/src/SVGEllipseElement.cpp | 11 ++++++++-
 layout/reftests/svg/reftest.list              |  1 +
 layout/reftests/svg/stroke-dasharray-02.svg   | 23 +++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 layout/reftests/svg/stroke-dasharray-02.svg

diff --git a/content/svg/content/src/SVGEllipseElement.cpp b/content/svg/content/src/SVGEllipseElement.cpp
index e405500f8416..d82d939ac39d 100644
--- a/content/svg/content/src/SVGEllipseElement.cpp
+++ b/content/svg/content/src/SVGEllipseElement.cpp
@@ -95,6 +95,15 @@ SVGEllipseElement::GetLengthInfo()
 void
 SVGEllipseElement::ConstructPath(gfxContext *aCtx)
 {
+  if (!aCtx->IsCairo()) {
+    RefPtr<Path> path = BuildPath();
+    if (path) {
+      gfxPath gfxpath(path);
+      aCtx->SetPath(&gfxpath);
+    }
+    return;
+  }
+
   float x, y, rx, ry;
 
   GetAnimatedLengthValues(&x, &y, &rx, &ry, nullptr);
@@ -116,7 +125,7 @@ SVGEllipseElement::BuildPath()
 
   RefPtr<PathBuilder> pathBuilder = CreatePathBuilder();
 
-  AppendEllipseToPath(pathBuilder, Point(x, y), Size(2.0*rx, 2.0*ry));
+  ArcToBezier(pathBuilder.get(), Point(x, y), Size(rx, ry), 0, Float(2*M_PI), false);
 
   return pathBuilder->Finish();
 }
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 001bc0355343..4d83eed91f74 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -319,6 +319,7 @@ HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
 fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
+== stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg 
 == stroke-dashoffset-01.svg pass.svg
diff --git a/layout/reftests/svg/stroke-dasharray-02.svg b/layout/reftests/svg/stroke-dasharray-02.svg
new file mode 100644
index 000000000000..ec1c449473c5
--- /dev/null
+++ b/layout/reftests/svg/stroke-dasharray-02.svg
@@ -0,0 +1,23 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <title>Test the start point and direction of dashing on circle and ellipse</title>
+
+  <!-- https://bugzilla.mozilla.org/show_bug.cgi?id=944704 -->
+
+  <rect width="100%" height="100%" fill="lime"/>
+
+  <!-- Test ellipse element dashes cover two red circles -->
+  <circle cx="95" cy="211" r="8" fill="red"/>
+  <circle cx="47" cy="225" r="8" fill="red"/>
+  <ellipse cx="50" cy="200" rx="50" ry="25" fill="none" stroke="lime" stroke-width="25" stroke-dasharray="25 25 25 100000"/>
+
+  <!-- Sanity test to check that two circles cover ellipse element dashes (i.e. that the previous check didn't pass because the stroke was solid) -->
+  <ellipse cx="200" cy="200" rx="50" ry="25" fill="none" stroke="red" stroke-width="10" stroke-dasharray="10 40 10 100000"/>
+  <circle cx="250" cy="205" r="11" fill="lime"/>
+  <circle cx="206" cy="225" r="11" fill="lime"/>
+
+</svg>

From f36cf5885cddf41c32c96beba0b572a0b6b85cbe Mon Sep 17 00:00:00 2001
From: Kannan Vijayan <kvijayan@mozilla.com>
Date: Fri, 13 Dec 2013 08:37:46 -0500
Subject: [PATCH 040/144] Bug 949496 - Correctly handle frame return values
 when bailing to baseline. r=jandem

---
 js/src/jit/BaselineBailouts.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index 9cba919eef9c..d2fccb1da4fa 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -587,8 +587,10 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
             }
         }
 
-        // Second slot holds the return value.
+        // Make sure to add HAS_RVAL to flags here because setFlags() below
+        // will clobber it.
         returnValue = iter.read();
+        flags |= BaselineFrame::HAS_RVAL;
 
         // If script maybe has an arguments object, the third slot will hold it.
         if (script->argumentsHasVarBinding()) {
@@ -603,8 +605,7 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
     IonSpew(IonSpew_BaselineBailouts, "      ReturnValue=%016llx", *((uint64_t *) &returnValue));
     blFrame->setReturnValue(returnValue);
 
-    // Do not need to initialize scratchValue or returnValue fields in BaselineFrame.
-
+    // Do not need to initialize scratchValue field in BaselineFrame.
     blFrame->setFlags(flags);
 
     // initArgsObjUnchecked modifies the frame's flags, so call it after setFlags.

From 12453ea7a3ac4518771b167ca25edcd06a879318 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 13:41:46 +0000
Subject: [PATCH 041/144] Bug 944704 follow-up to mark
 zoomed-svg-with-viewBox-01.svg very slightly fuzzy on windows. r=orange

---
 layout/reftests/svg/reftest.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 4d83eed91f74..ddec78aef847 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -319,7 +319,7 @@ HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
 fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
-== stroke-dasharray-02.svg pass.svg
+fuzzy-if(winWidget,12,7) == stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg 
 == stroke-dashoffset-01.svg pass.svg

From c21b58cae24cc128066bab99c35c605c0bbebcfb Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 13:43:58 +0000
Subject: [PATCH 042/144] Bug 944704 follow-up to mark
 zoomed-svg-with-viewBox-01.svg very slightly fuzzy on windows. r=orange

---
 layout/reftests/svg/moz-only/reftest.list | 2 +-
 layout/reftests/svg/reftest.list          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/layout/reftests/svg/moz-only/reftest.list b/layout/reftests/svg/moz-only/reftest.list
index b91d2fec0deb..a21d70834598 100644
--- a/layout/reftests/svg/moz-only/reftest.list
+++ b/layout/reftests/svg/moz-only/reftest.list
@@ -19,4 +19,4 @@ skip-if(B2G) random-if(d2d) == feImage-zoom-01a.svg          feImage-zoom-01-ref
 skip-if(B2G) random-if(d2d) == feImage-zoom-01b.svg          feImage-zoom-01-ref.svg # bug 773482
 skip-if(B2G) == foreignObject-zoom-01.svg                    pass.svg # bug 773482
 skip-if(B2G) == zoom-invalidation-01.svg                     pass.svg # bug 773482
-== zoomed-svg-with-viewBox-01.svg          zoomed-svg-with-viewBox-01-ref.svg
+fuzzy-if(winWidget,12,7) == zoomed-svg-with-viewBox-01.svg   zoomed-svg-with-viewBox-01-ref.svg
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index ddec78aef847..4d83eed91f74 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -319,7 +319,7 @@ HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
 fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
-fuzzy-if(winWidget,12,7) == stroke-dasharray-02.svg pass.svg
+== stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg 
 == stroke-dashoffset-01.svg pass.svg

From 1da060fb8985be26a6af4f5ce7293ae21ad90705 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Fri, 13 Dec 2013 15:22:37 +0100
Subject: [PATCH 043/144] Bug 946540: Deal with inflection points that all lie
 outside of (0, 1). r=jrmuizel

---
 gfx/2d/Path.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gfx/2d/Path.cpp b/gfx/2d/Path.cpp
index c3902e816d94..a505d921e018 100644
--- a/gfx/2d/Path.cpp
+++ b/gfx/2d/Path.cpp
@@ -407,7 +407,8 @@ FlattenBezier(const BezierControlPoints &aControlPoints,
     return;
   }
 
-  if (count == 0) {
+  // Check that at least one of the inflection points is inside [0..1]
+  if (count == 0 || ((t1 < 0 || t1 > 1.0) && ((t2 < 0 || t2 > 1.0) || count == 1)) ) {
     FlattenBezierCurveSegment(aControlPoints, aSink, aTolerance);
     return;
   }

From 912bf8a84622f675678601bc1b1fed33cae5dd06 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 13 Dec 2013 09:55:39 -0500
Subject: [PATCH 044/144] Bug 940821 - Build crashreporter in unified mode;
 r=ted

---
 toolkit/crashreporter/InjectCrashReporter.h   |  5 +++++
 .../crashreporter/client/crashreporter.cpp    | 20 +++++++++----------
 .../client/crashreporter_win.cpp              |  4 ++++
 toolkit/crashreporter/client/moz.build        | 10 +++++-----
 .../client/linux/crash_generation/moz.build   |  2 +-
 .../src/client/linux/handler/moz.build        |  2 +-
 .../client/linux/minidump_writer/moz.build    |  2 +-
 .../src/client/mac/crash_generation/moz.build |  2 +-
 .../src/client/mac/handler/moz.build          |  2 +-
 .../google-breakpad/src/common/Makefile.in    |  7 -------
 .../src/common/linux/moz.build                | 10 +++++++---
 .../google-breakpad/src/common/mac/moz.build  |  4 ++--
 .../google-breakpad/src/common/moz.build      | 14 ++++++-------
 .../src/common/solaris/moz.build              |  2 +-
 .../google-breakpad/src/processor/moz.build   |  2 +-
 toolkit/crashreporter/moz.build               |  6 +++---
 toolkit/crashreporter/test/moz.build          |  2 +-
 17 files changed, 50 insertions(+), 46 deletions(-)

diff --git a/toolkit/crashreporter/InjectCrashReporter.h b/toolkit/crashreporter/InjectCrashReporter.h
index c315277f5e6a..38c62acfc38b 100644
--- a/toolkit/crashreporter/InjectCrashReporter.h
+++ b/toolkit/crashreporter/InjectCrashReporter.h
@@ -3,6 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef InjectCrashReporter_h
+#define InjectCrashReporter_h
+
 #include "nsThreadUtils.h"
 #include <windows.h>
 
@@ -21,3 +24,5 @@ private:
 };
   
 } // Namespace mozilla
+
+#endif
diff --git a/toolkit/crashreporter/client/crashreporter.cpp b/toolkit/crashreporter/client/crashreporter.cpp
index 5e43ea0bdce7..d00311ed933e 100644
--- a/toolkit/crashreporter/client/crashreporter.cpp
+++ b/toolkit/crashreporter/client/crashreporter.cpp
@@ -36,7 +36,7 @@ int          gArgc;
 char**       gArgv;
 
 static auto_ptr<ofstream> gLogStream(nullptr);
-static string             gDumpFile;
+static string             gReporterDumpFile;
 static string             gExtraFile;
 
 static string kExtraDataExtension = ".extra";
@@ -323,8 +323,8 @@ void DeleteDump()
 {
   const char* noDelete = getenv("MOZ_CRASHREPORTER_NO_DELETE_DUMP");
   if (!noDelete || *noDelete == '\0') {
-    if (!gDumpFile.empty())
-      UIDeleteFile(gDumpFile);
+    if (!gReporterDumpFile.empty())
+      UIDeleteFile(gReporterDumpFile);
     if (!gExtraFile.empty())
       UIDeleteFile(gExtraFile);
   }
@@ -337,7 +337,7 @@ void SendCompleted(bool success, const string& serverResponse)
       DeleteDump();
     }
     else {
-      string directory = gDumpFile;
+      string directory = gReporterDumpFile;
       int slashpos = directory.find_last_of("/\\");
       if (slashpos < 2)
         return;
@@ -446,14 +446,14 @@ int main(int argc, char** argv)
     return 0;
 
   if (argc > 1) {
-    gDumpFile = argv[1];
+    gReporterDumpFile = argv[1];
   }
 
-  if (gDumpFile.empty()) {
+  if (gReporterDumpFile.empty()) {
     // no dump file specified, run the default UI
     UIShowDefaultUI();
   } else {
-    gExtraFile = GetExtraDataFilename(gDumpFile);
+    gExtraFile = GetExtraDataFilename(gReporterDumpFile);
     if (gExtraFile.empty()) {
       UIError(gStrings[ST_ERROR_BADARGUMENTS]);
       return 0;
@@ -514,13 +514,13 @@ int main(int argc, char** argv)
 
     OpenLogFile();
 
-    if (!UIFileExists(gDumpFile)) {
+    if (!UIFileExists(gReporterDumpFile)) {
       UIError(gStrings[ST_ERROR_DUMPFILEEXISTS]);
       return 0;
     }
 
     string pendingDir = gSettingsPath + UI_DIR_SEPARATOR + "pending";
-    if (!MoveCrashData(pendingDir, gDumpFile, gExtraFile)) {
+    if (!MoveCrashData(pendingDir, gReporterDumpFile, gExtraFile)) {
       return 0;
     }
 
@@ -575,7 +575,7 @@ int main(int argc, char** argv)
        return 0;
      }
 
-    if (!UIShowCrashUI(gDumpFile, queryParameters, sendURL, restartArgs))
+    if (!UIShowCrashUI(gReporterDumpFile, queryParameters, sendURL, restartArgs))
       DeleteDump();
   }
 
diff --git a/toolkit/crashreporter/client/crashreporter_win.cpp b/toolkit/crashreporter/client/crashreporter_win.cpp
index 69c1864164d5..3f2f597cf60f 100644
--- a/toolkit/crashreporter/client/crashreporter_win.cpp
+++ b/toolkit/crashreporter/client/crashreporter_win.cpp
@@ -35,6 +35,10 @@
 
 #define WM_UPLOADCOMPLETE WM_APP
 
+// Thanks, Windows.h :(
+#undef min
+#undef max
+
 using std::string;
 using std::wstring;
 using std::map;
diff --git a/toolkit/crashreporter/client/moz.build b/toolkit/crashreporter/client/moz.build
index bc2d59715c0b..e5b938bb37fd 100644
--- a/toolkit/crashreporter/client/moz.build
+++ b/toolkit/crashreporter/client/moz.build
@@ -8,18 +8,18 @@ if CONFIG['OS_TARGET'] != 'Android':
     PROGRAM = 'crashreporter'
 # The xpcshell test case here verifies that the CA certificate list
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'crashreporter.cpp',
 ]
 
 if CONFIG['OS_ARCH'] == 'WINNT':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_win.cpp',
     ]
     DEFINES['UNICODE'] = True
     DEFINES['_UNICODE'] = True
 elif CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_unix_common.cpp',
     ]
 elif CONFIG['OS_ARCH'] == 'SunOS':
@@ -29,13 +29,13 @@ elif CONFIG['OS_ARCH'] == 'SunOS':
     ]
 
 if CONFIG['MOZ_ENABLE_GTK']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_gtk_common.cpp',
         'crashreporter_linux.cpp',
         'crashreporter_unix_common.cpp'
         ]
 
 if CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_osx.mm',
     ]
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build b/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build
index 80b84c416e7f..99439b9ff769 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'crash_generation_client.cc',
     'crash_generation_server.cc',
 ]
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build b/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build
index 837b28422ac9..934f2cb58c29 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     '../log/log.cc',
     'exception_handler.cc',
     'minidump_descriptor.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build b/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build
index 13e04e1651d0..7fb163eb5c2c 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'linux_dumper.cc',
     'linux_ptrace_dumper.cc',
     'minidump_writer.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build b/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build
index 1667edeb8220..ef24c724a105 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'crash_generation_client.cc',
     'crash_generation_server.cc',
 ]
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build
index 44696c5f941f..e5938e280e14 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'breakpad_nlist_64.cc',
     'dynamic_images.cc',
     'exception_handler.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/common/Makefile.in b/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
index 9c463d44d21d..38a65ab2a880 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
@@ -25,10 +25,3 @@ OS_CXXFLAGS += -DHAVE_MACH_O_NLIST_H
 endif
 
 include $(topsrcdir)/config/rules.mk
-
-ifneq (WINNT,$(OS_TARGET))
-# Headers from this directory are included as "common/header.h". Having
-# -I$(srcdir) on the command line makes us use common/memory.h when
-# <memory.h> is included from system headers, which is not intended.
-INCLUDES = $(LOCAL_INCLUDES) -I$(DIST)/include
-endif
diff --git a/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build b/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
index 9af1365e8a56..d54190456f26 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
@@ -4,17 +4,21 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'elfutils.cc',
-    'file_id.cc',
     'guid_creator.cc',
     'linux_libc_support.cc',
     'memory_mapped_file.cc',
     'safe_readlink.cc',
 ]
 
+# file_id.cc cannot be built in unified mode because it uses a custom STL_FLAGS
+SOURCES += [
+    'file_id.cc',
+]
+
 if CONFIG['OS_TARGET'] != 'Android':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'http_upload.cc',
     ]
 
diff --git a/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build b/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build
index 86fb60c332ac..bc785a110583 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'arch_utilities.cc',
     'bootstrap_compat.cc',
     'file_id.cc',
@@ -19,7 +19,7 @@ SOURCES += [
 # The host lib is used for dump_syms, and the target lib for the
 # crash reporter client.  Therefore, we don't need all the srcs in both.
 if CONFIG['MOZ_CRASHREPORTER']:
-    HOST_SOURCES += SOURCES
+    HOST_SOURCES += UNIFIED_SOURCES
     HOST_SOURCES += [
         'dump_syms.mm',
     ]
diff --git a/toolkit/crashreporter/google-breakpad/src/common/moz.build b/toolkit/crashreporter/google-breakpad/src/common/moz.build
index 4b5f4d0b3dd3..37a5d9350ea0 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/moz.build
@@ -7,11 +7,8 @@
 if CONFIG['OS_ARCH'] in ('Darwin', 'Linux'):
     DIRS += ['dwarf']
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'convert_UTF.c',
-]
-
-SOURCES += [
     'logging.cc',
     'module.cc',
     'pathname_stripper.cc',
@@ -20,7 +17,7 @@ SOURCES += [
 ]
 
 if CONFIG['OS_TARGET'] != 'WINNT':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'arm_ex_reader.cc',
         'arm_ex_to_module.cc',
         'dwarf/bytereader.cc',
@@ -34,7 +31,7 @@ if CONFIG['OS_TARGET'] != 'WINNT':
     ]
 
 if CONFIG['OS_ARCH'] == 'Linux':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'linux/dump_symbols.cc',
         'linux/elf_symbols_to_module.cc',
     ]
@@ -43,7 +40,7 @@ if CONFIG['OS_TARGET'] == 'Android':
     pass
 else:
     if CONFIG['OS_TARGET'] != 'WINNT':
-        SOURCES += [
+        UNIFIED_SOURCES += [
             'stabs_reader.cc',
             'stabs_to_module.cc',
         ]
@@ -69,11 +66,12 @@ if CONFIG['OS_TARGET'] != 'WINNT' and CONFIG['MOZ_CRASHREPORTER']:
     ]
 
 if CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'mac/dump_syms.mm',
     ]
 
 if CONFIG['OS_TARGET'] == 'Android':
+    # We don't support unifying assembly files.
     SOURCES += [
         'android/breakpad_getcontext.S',
     ]
diff --git a/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build b/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build
index c84c532f7ef0..d32c5f6d4694 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'dump_symbols.cc',
     'file_id.cc',
     'guid_creator.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/processor/moz.build b/toolkit/crashreporter/google-breakpad/src/processor/moz.build
index d1fb342f6e68..2812b12d78d2 100644
--- a/toolkit/crashreporter/google-breakpad/src/processor/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/processor/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'basic_code_modules.cc',
     'basic_source_line_resolver.cc',
     'call_stack.cc',
diff --git a/toolkit/crashreporter/moz.build b/toolkit/crashreporter/moz.build
index c09f9dcddf6e..312a81d52a95 100644
--- a/toolkit/crashreporter/moz.build
+++ b/toolkit/crashreporter/moz.build
@@ -50,7 +50,7 @@ DIRS += ['client']
 
 if CONFIG['MOZ_CRASHREPORTER_INJECTOR']:
     DIRS += ['injector']
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'InjectCrashReporter.cpp',
         'LoadLibraryRemote.cpp',
     ]
@@ -61,12 +61,12 @@ EXPORTS += [
     'nsExceptionHandler.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'nsExceptionHandler.cpp',
 ]
 
 if CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'mac_utils.mm',
     ]
 
diff --git a/toolkit/crashreporter/test/moz.build b/toolkit/crashreporter/test/moz.build
index d4a143826186..bea32bc8813b 100644
--- a/toolkit/crashreporter/test/moz.build
+++ b/toolkit/crashreporter/test/moz.build
@@ -8,7 +8,7 @@ NO_DIST_INSTALL = True
 XPCSHELL_TESTS_MANIFESTS += ['unit/xpcshell.ini', 'unit_ipc/xpcshell.ini']
 BROWSER_CHROME_MANIFESTS += ['browser/browser.ini']
 
-SOURCES += [
+UNIFIED_SOURCES += [
     '../google-breakpad/src/common/logging.cc',
     '../google-breakpad/src/common/pathname_stripper.cc',
     '../google-breakpad/src/processor/basic_code_modules.cc',

From 501e006ac9362fe93ae27b0d085ccf94437a0a52 Mon Sep 17 00:00:00 2001
From: Julian Seward <jseward@acm.org>
Date: Fri, 13 Dec 2013 12:40:24 +0100
Subject: [PATCH 045/144] Bug 867597 - IonMonkey: ARM hwcaps detection depends
 on uninitialised garbage on the stack.  r=mjrosenb

--HG--
extra : rebase_source : aaa617de72c55552bd63f23d392e25785c1bf65a
---
 js/src/jit/arm/Architecture-arm.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/arm/Architecture-arm.cpp b/js/src/jit/arm/Architecture-arm.cpp
index 2c21891fba82..952c830f0e0d 100644
--- a/js/src/jit/arm/Architecture-arm.cpp
+++ b/js/src/jit/arm/Architecture-arm.cpp
@@ -71,7 +71,8 @@ uint32_t GetARMFlags()
         return false;
 
     char buf[1024];
-    fread(buf, sizeof(char), sizeof(buf), fp);
+    memset(buf, 0, sizeof(buf));
+    fread(buf, sizeof(char), sizeof(buf)-1, fp);
     fclose(fp);
     if (strstr(buf, "vfp"))
         flags |= HWCAP_VFP;

From 5477bd694306033337486f8e5c151aaa01ef3e41 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Fri, 13 Dec 2013 16:36:29 +0200
Subject: [PATCH 046/144] Bug 944847, don't try to compile event handlers for
 data documents, r=bz

--HG--
extra : rebase_source : 2b4ce65fad2433475f4b50ccd89b4301cee6c8b2
---
 content/events/src/nsEventListenerManager.cpp |  4 +-
 content/events/test/mochitest.ini             |  1 +
 content/events/test/test_bug944847.html       | 42 +++++++++++++++++++
 3 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 content/events/test/test_bug944847.html

diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index bcdda331095b..5fbb90c768c0 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -1347,7 +1347,9 @@ nsEventListenerManager::GetScriptGlobalAndDocument(nsIDocument** aDoc)
     // XXX sXBL/XBL2 issue -- do we really want the owner here?  What
     // if that's the XBL document?
     doc = node->OwnerDoc();
-    MOZ_ASSERT(!doc->IsLoadedAsData(), "Should not get in here at all");
+    if (doc->IsLoadedAsData()) {
+      return nullptr;
+    }
 
     // We want to allow compiling an event handler even in an unloaded
     // document, so use GetScopeObject here, not GetScriptHandlingObject.
diff --git a/content/events/test/mochitest.ini b/content/events/test/mochitest.ini
index 53e20c50f22f..c42d5277e837 100644
--- a/content/events/test/mochitest.ini
+++ b/content/events/test/mochitest.ini
@@ -84,6 +84,7 @@ skip-if = true # Disabled due to timeouts.
 [test_bug855741.html]
 [test_bug864040.html]
 [test_bug930374-content.html]
+[test_bug944847.html]
 skip-if = toolkit == "gonk"
 [test_clickevent_on_input.html]
 [test_continuous_wheel_events.html]
diff --git a/content/events/test/test_bug944847.html b/content/events/test/test_bug944847.html
new file mode 100644
index 000000000000..105c0d5c93dd
--- /dev/null
+++ b/content/events/test/test_bug944847.html
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=944847
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 944847</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 944847 **/
+
+    var e1 = document.createElement("div");
+    is(e1.onclick, null);
+    e1.setAttribute("onclick", "");
+    isnot(e1.onclick, null);
+
+    var e2 = document.implementation.createHTMLDocument(null, null).createElement("div");
+    is(e2.onclick, null);
+    e2.setAttribute("onclick", "");
+    is(e2.onclick, null);
+
+    var e3 = document.createElement("div");
+    is(e3.onclick, null);
+    e3.setAttribute("onclick", "");
+    e2.ownerDocument.adoptNode(e3);
+    is(e3.onclick, null);
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=944847">Mozilla Bug 944847</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

From 9d189300bb7c81e32df5dc4eb616f6c00611e86e Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Fri, 13 Dec 2013 11:26:35 -0500
Subject: [PATCH 047/144] Bug 943612 - don't use GetPosAndText to convert
 offsets to DOM range, r=tbsaunde

---
 .../src/generic/HyperTextAccessible.cpp       | 93 +++++++++++--------
 accessible/src/generic/HyperTextAccessible.h  | 26 ++++--
 2 files changed, 73 insertions(+), 46 deletions(-)

diff --git a/accessible/src/generic/HyperTextAccessible.cpp b/accessible/src/generic/HyperTextAccessible.cpp
index 3770733b8e00..3baed7afd17c 100644
--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -548,14 +548,34 @@ HyperTextAccessible::DOMPointToHypertextOffset(nsINode* aNode,
   return nullptr;
 }
 
-nsresult
-HyperTextAccessible::HypertextOffsetsToDOMRange(int32_t aStartHTOffset,
-                                                int32_t aEndHTOffset,
-                                                nsRange* aRange)
+bool
+HyperTextAccessible::OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
+                                       nsRange* aRange)
 {
-  // If the given offsets are 0 and associated editor is empty then return
-  // collapsed range with editor root element as range container.
-  if (aStartHTOffset == 0 && aEndHTOffset == 0) {
+  DOMPoint startPoint = OffsetToDOMPoint(aStartOffset);
+  if (!startPoint.node)
+    return false;
+
+  aRange->SetStart(startPoint.node, startPoint.idx);
+  if (aStartOffset == aEndOffset) {
+    aRange->SetEnd(startPoint.node, startPoint.idx);
+    return true;
+  }
+
+  DOMPoint endPoint = OffsetToDOMPoint(aEndOffset);
+  if (!endPoint.node)
+    return false;
+
+  aRange->SetEnd(endPoint.node, endPoint.idx);
+  return true;
+}
+
+DOMPoint
+HyperTextAccessible::OffsetToDOMPoint(int32_t aOffset)
+{
+  // 0 offset is valid even if no children. In this case the associated editor
+  // is empty so return a DOM point for editor root element.
+  if (aOffset == 0) {
     nsCOMPtr<nsIEditor> editor = GetEditor();
     if (editor) {
       bool isEmpty = false;
@@ -565,40 +585,36 @@ HyperTextAccessible::HypertextOffsetsToDOMRange(int32_t aStartHTOffset,
         editor->GetRootElement(getter_AddRefs(editorRootElm));
 
         nsCOMPtr<nsINode> editorRoot(do_QueryInterface(editorRootElm));
-        if (editorRoot) {
-          aRange->SetStart(editorRoot, 0);
-          aRange->SetEnd(editorRoot, 0);
-
-          return NS_OK;
-        }
+        return DOMPoint(editorRoot, 0);
       }
     }
   }
 
-  nsRefPtr<Accessible> startAcc, endAcc;
-  int32_t startOffset = aStartHTOffset, endOffset = aEndHTOffset;
-  nsIFrame *startFrame = nullptr, *endFrame = nullptr;
+  int32_t childIdx = GetChildIndexAtOffset(aOffset);
+  if (childIdx == -1)
+    return DOMPoint();
 
-  startFrame = GetPosAndText(startOffset, endOffset, nullptr, &endFrame,
-                             getter_AddRefs(startAcc), getter_AddRefs(endAcc));
-  if (!startAcc || !endAcc)
-    return NS_ERROR_FAILURE;
+  Accessible* child = GetChildAt(childIdx);
+  int32_t innerOffset = aOffset - GetChildOffset(childIdx);
 
-  DOMPoint startPoint, endPoint;
-  nsresult rv = GetDOMPointByFrameOffset(startFrame, startOffset, startAcc,
-                                         &startPoint);
-  NS_ENSURE_SUCCESS(rv, rv);
+  // A text leaf case. The point is inside the text node.
+  if (child->IsTextLeaf()) {
+    nsIContent* content = child->GetContent();
+    int32_t idx = 0;
+    if (NS_FAILED(RenderedToContentOffset(content->GetPrimaryFrame(),
+                                          innerOffset, &idx)))
+      return DOMPoint();
 
-  rv = aRange->SetStart(startPoint.node, startPoint.idx);
-  NS_ENSURE_SUCCESS(rv, rv);
+    return DOMPoint(content, idx);
+  }
 
-  if (aStartHTOffset == aEndHTOffset)
-    return aRange->SetEnd(startPoint.node, startPoint.idx);
-
-  rv = GetDOMPointByFrameOffset(endFrame, endOffset, endAcc, &endPoint);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return aRange->SetEnd(endPoint.node, endPoint.idx);
+  // Case of embedded object. The point is either before or after the element.
+  NS_ASSERTION(innerOffset == 0 || innerOffset == 1, "A wrong inner offset!");
+  nsINode* node = child->GetNode();
+  nsINode* parentNode = node->GetParentNode();
+  return parentNode ?
+    DOMPoint(parentNode, parentNode->IndexOf(node) + innerOffset) :
+    DOMPoint();
 }
 
 int32_t
@@ -1580,7 +1596,8 @@ HyperTextAccessible::SetSelectionBoundsAt(int32_t aSelectionNum,
   if (!range)
     return false;
 
-  HypertextOffsetsToDOMRange(startOffset, endOffset, range);
+  if (!OffsetsToDOMRange(startOffset, endOffset, range))
+    return false;
 
   // If new range was created then add it, otherwise notify selection listeners
   // that existing selection range was changed.
@@ -1610,8 +1627,7 @@ HyperTextAccessible::ScrollSubstringTo(int32_t aStartOffset, int32_t aEndOffset,
                                        uint32_t aScrollType)
 {
   nsRefPtr<nsRange> range = new nsRange(mContent);
-  nsresult rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset, range);
-  if (NS_SUCCEEDED(rv))
+  if (OffsetsToDOMRange(aStartOffset, aEndOffset, range))
     nsCoreUtils::ScrollSubstringTo(GetFrame(), range, aScrollType);
 }
 
@@ -1629,8 +1645,7 @@ HyperTextAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
                                                         this);
 
   nsRefPtr<nsRange> range = new nsRange(mContent);
-  nsresult rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset, range);
-  if (NS_FAILED(rv))
+  if (!OffsetsToDOMRange(aStartOffset, aEndOffset, range))
     return;
 
   nsPresContext* presContext = frame->PresContext();
@@ -1658,7 +1673,7 @@ HyperTextAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
         int16_t hPercent = offsetPointX * 100 / size.width;
         int16_t vPercent = offsetPointY * 100 / size.height;
 
-        rv = nsCoreUtils::ScrollSubstringTo(frame, range, vPercent, hPercent);
+        nsresult rv = nsCoreUtils::ScrollSubstringTo(frame, range, vPercent, hPercent);
         if (NS_FAILED(rv))
           return;
 
diff --git a/accessible/src/generic/HyperTextAccessible.h b/accessible/src/generic/HyperTextAccessible.h
index b7b33fa378d1..93396c119076 100644
--- a/accessible/src/generic/HyperTextAccessible.h
+++ b/accessible/src/generic/HyperTextAccessible.h
@@ -17,6 +17,9 @@ namespace mozilla {
 namespace a11y {
 
 struct DOMPoint {
+  DOMPoint() : node(nullptr), idx(0) { }
+  DOMPoint(nsINode* aNode, int32_t aIdx) : node(aNode), idx(aIdx) { }
+
   nsINode* node;
   int32_t idx;
 };
@@ -128,15 +131,24 @@ public:
                                         bool aIsEndOffset = false) const;
 
   /**
-   * Turn a start and end hypertext offsets into DOM range.
+   * Convert start and end hypertext offsets into DOM range.
    *
-   * @param  aStartHTOffset  [in] the given start hypertext offset
-   * @param  aEndHTOffset    [in] the given end hypertext offset
-   * @param  aRange      [out] the range whose bounds to set
+   * @param  aStartOffset  [in] the given start hypertext offset
+   * @param  aEndOffset    [in] the given end hypertext offset
+   * @param  aRange        [in, out] the range whose bounds to set
+   * @return true   if conversion was successful
    */
-  nsresult HypertextOffsetsToDOMRange(int32_t aStartHTOffset,
-                                      int32_t aEndHTOffset,
-                                      nsRange* aRange);
+  bool OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
+                         nsRange* aRange);
+
+  /**
+   * Convert the given offset into DOM point.
+   *
+   * If offset is at text leaf then DOM point is (text node, offsetInTextNode),
+   * if before embedded object then (parent node, indexInParent), if after then
+   * (parent node, indexInParent + 1).
+   */
+  DOMPoint OffsetToDOMPoint(int32_t aOffset);
 
   /**
    * Return true if the used ARIA role (if any) allows the hypertext accessible

From 7185e14125d3ca3e26b667aa6799c616fff38d31 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:46 -0800
Subject: [PATCH 048/144] Bug 949668 - SpiderMonkey: Rename MoveResolver::Move
 to MoveOp. r=jandem

---
 js/src/jit/CodeGenerator.cpp                  |   4 +-
 js/src/jit/MoveResolver.cpp                   |   2 +-
 js/src/jit/MoveResolver.h                     | 286 +++++++++---------
 js/src/jit/arm/CodeGenerator-arm.cpp          |   2 -
 js/src/jit/arm/CodeGenerator-arm.h            |   2 +-
 js/src/jit/arm/MacroAssembler-arm.cpp         |  12 +-
 js/src/jit/arm/MacroAssembler-arm.h           |   5 +-
 js/src/jit/arm/MoveEmitter-arm.cpp            |  12 +-
 js/src/jit/arm/MoveEmitter-arm.h              |   9 +-
 js/src/jit/arm/Trampoline-arm.cpp             |   2 -
 .../jit/shared/CodeGenerator-x86-shared.cpp   |   2 -
 js/src/jit/shared/CodeGenerator-x86-shared.h  |   2 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp  |  16 +-
 js/src/jit/shared/MoveEmitter-x86-shared.h    |   7 +-
 js/src/jit/x64/MacroAssembler-x64.cpp         |   6 +-
 js/src/jit/x64/MacroAssembler-x64.h           |   3 -
 js/src/jit/x64/Trampoline-x64.cpp             |   2 -
 js/src/jit/x86/MacroAssembler-x86.cpp         |   4 +-
 js/src/jit/x86/MacroAssembler-x86.h           |   3 -
 js/src/jit/x86/Trampoline-x86.cpp             |   2 -
 20 files changed, 178 insertions(+), 205 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index b9c2d6bd1525..b6fac075a84a 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1183,9 +1183,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveResolver::Move::Kind kind = from->isDouble()
-                                        ? MoveResolver::Move::DOUBLE
-                                        : MoveResolver::Move::GENERAL;
+        MoveOp::Kind kind = from->isDouble() ? MoveOp::DOUBLE : MoveOp::GENERAL;
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
diff --git a/js/src/jit/MoveResolver.cpp b/js/src/jit/MoveResolver.cpp
index 522bd3b17470..4354f24d8ef5 100644
--- a/js/src/jit/MoveResolver.cpp
+++ b/js/src/jit/MoveResolver.cpp
@@ -21,7 +21,7 @@ MoveResolver::resetState()
 }
 
 bool
-MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // Assert that we're not doing no-op moves.
     JS_ASSERT(!(from == to));
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 601113b8ac01..bbe6f1201a32 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -14,156 +14,156 @@
 namespace js {
 namespace jit {
 
+// This is similar to Operand, but carries more information. We're also not
+// guaranteed that Operand looks like this on all ISAs.
+class MoveOperand
+{
+    enum Kind {
+        REG,
+        FLOAT_REG,
+        ADDRESS,
+        FLOAT_ADDRESS,
+        EFFECTIVE_ADDRESS
+    };
+
+    Kind kind_;
+    uint32_t code_;
+    int32_t disp_;
+
+  public:
+    enum AddressKind {
+        MEMORY = ADDRESS,
+        EFFECTIVE = EFFECTIVE_ADDRESS,
+        FLOAT = FLOAT_ADDRESS
+    };
+
+    MoveOperand()
+    { }
+    explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
+    { }
+    explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
+    { }
+    MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
+        : kind_((Kind) addrKind),
+        code_(reg.code()),
+        disp_(disp)
+    {
+        // With a zero offset, this is a plain reg-to-reg move.
+        if (disp == 0 && addrKind == EFFECTIVE)
+            kind_ = REG;
+    }
+    MoveOperand(const MoveOperand &other)
+      : kind_(other.kind_),
+        code_(other.code_),
+        disp_(other.disp_)
+    { }
+    bool isFloatReg() const {
+        return kind_ == FLOAT_REG;
+    }
+    bool isGeneralReg() const {
+        return kind_ == REG;
+    }
+    bool isDouble() const {
+        return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
+    }
+    bool isMemory() const {
+        return kind_ == ADDRESS;
+    }
+    bool isFloatAddress() const {
+        return kind_ == FLOAT_ADDRESS;
+    }
+    bool isEffectiveAddress() const {
+        return kind_ == EFFECTIVE_ADDRESS;
+    }
+    Register reg() const {
+        JS_ASSERT(isGeneralReg());
+        return Register::FromCode(code_);
+    }
+    FloatRegister floatReg() const {
+        JS_ASSERT(isFloatReg());
+        return FloatRegister::FromCode(code_);
+    }
+    Register base() const {
+        JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+        return Register::FromCode(code_);
+    }
+    int32_t disp() const {
+        return disp_;
+    }
+
+    bool operator ==(const MoveOperand &other) const {
+        if (kind_ != other.kind_)
+            return false;
+        if (code_ != other.code_)
+            return false;
+        if (isMemory() || isEffectiveAddress())
+            return disp_ == other.disp_;
+        return true;
+    }
+    bool operator !=(const MoveOperand &other) const {
+        return !operator==(other);
+    }
+};
+
+// This represents a move operation.
+class MoveOp
+{
+  protected:
+    MoveOperand from_;
+    MoveOperand to_;
+    bool cycle_;
+
+  public:
+    enum Kind {
+        GENERAL,
+        DOUBLE
+    };
+
+  protected:
+    Kind kind_;
+
+  public:
+    MoveOp()
+    { }
+    MoveOp(const MoveOp &other)
+      : from_(other.from_),
+        to_(other.to_),
+        cycle_(other.cycle_),
+        kind_(other.kind_)
+    { }
+    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+      : from_(from),
+        to_(to),
+        cycle_(cycle),
+        kind_(kind)
+    { }
+
+    bool inCycle() const {
+        return cycle_;
+    }
+    const MoveOperand &from() const {
+        return from_;
+    }
+    const MoveOperand &to() const {
+        return to_;
+    }
+    Kind kind() const {
+        return kind_;
+    }
+};
+
 class MoveResolver
 {
-  public:
-    // This is similar to Operand, but carries more information. We're also not
-    // guaranteed that Operand looks like this on all ISAs.
-    class MoveOperand
-    {
-        enum Kind {
-            REG,
-            FLOAT_REG,
-            ADDRESS,
-            FLOAT_ADDRESS,
-            EFFECTIVE_ADDRESS
-        };
-
-        Kind kind_;
-        uint32_t code_;
-        int32_t disp_;
-
-      public:
-        enum AddressKind {
-            MEMORY = ADDRESS,
-            EFFECTIVE = EFFECTIVE_ADDRESS,
-            FLOAT = FLOAT_ADDRESS
-        };
-
-        MoveOperand()
-        { }
-        explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
-        { }
-        explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
-        { }
-        MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
-            : kind_((Kind) addrKind),
-            code_(reg.code()),
-            disp_(disp)
-        {
-            // With a zero offset, this is a plain reg-to-reg move.
-            if (disp == 0 && addrKind == EFFECTIVE)
-                kind_ = REG;
-        }
-        MoveOperand(const MoveOperand &other)
-          : kind_(other.kind_),
-            code_(other.code_),
-            disp_(other.disp_)
-        { }
-        bool isFloatReg() const {
-            return kind_ == FLOAT_REG;
-        }
-        bool isGeneralReg() const {
-            return kind_ == REG;
-        }
-        bool isDouble() const {
-            return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
-        }
-        bool isMemory() const {
-            return kind_ == ADDRESS;
-        }
-        bool isFloatAddress() const {
-            return kind_ == FLOAT_ADDRESS;
-        }
-        bool isEffectiveAddress() const {
-            return kind_ == EFFECTIVE_ADDRESS;
-        }
-        Register reg() const {
-            JS_ASSERT(isGeneralReg());
-            return Register::FromCode(code_);
-        }
-        FloatRegister floatReg() const {
-            JS_ASSERT(isFloatReg());
-            return FloatRegister::FromCode(code_);
-        }
-        Register base() const {
-            JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
-            return Register::FromCode(code_);
-        }
-        int32_t disp() const {
-            return disp_;
-        }
-
-        bool operator ==(const MoveOperand &other) const {
-            if (kind_ != other.kind_)
-                return false;
-            if (code_ != other.code_)
-                return false;
-            if (isMemory() || isEffectiveAddress())
-                return disp_ == other.disp_;
-            return true;
-        }
-        bool operator !=(const MoveOperand &other) const {
-            return !operator==(other);
-        }
-    };
-
-    class Move
-    {
-      protected:
-        MoveOperand from_;
-        MoveOperand to_;
-        bool cycle_;
-
-      public:
-        enum Kind {
-            GENERAL,
-            DOUBLE
-        };
-
-      protected:
-        Kind kind_;
-
-      public:
-        Move()
-        { }
-        Move(const Move &other)
-          : from_(other.from_),
-            to_(other.to_),
-            cycle_(other.cycle_),
-            kind_(other.kind_)
-        { }
-        Move(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
-          : from_(from),
-            to_(to),
-            cycle_(cycle),
-            kind_(kind)
-        { }
-
-        bool inCycle() const {
-            return cycle_;
-        }
-        const MoveOperand &from() const {
-            return from_;
-        }
-        const MoveOperand &to() const {
-            return to_;
-        }
-        Kind kind() const {
-            return kind_;
-        }
-    };
-
   private:
     struct PendingMove
-      : public Move,
+      : public MoveOp,
         public TempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : Move(from, to, kind, false)
+          : MoveOp(from, to, kind, false)
         { }
         
         void setInCycle() {
@@ -178,7 +178,7 @@ class MoveResolver
   private:
     // Moves that are definitely unblocked (constants to registers). These are
     // emitted last.
-    js::Vector<Move, 16, SystemAllocPolicy> orderedMoves_;
+    js::Vector<MoveOp, 16, SystemAllocPolicy> orderedMoves_;
     bool hasCycles_;
 
     TempObjectPool<PendingMove> movePool_;
@@ -200,13 +200,13 @@ class MoveResolver
     //
     // After calling addMove() for each parallel move, resolve() performs the
     // cycle resolution algorithm. Calling addMove() again resets the resolver.
-    bool addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    bool addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
     bool resolve();
 
     size_t numMoves() const {
         return orderedMoves_.length();
     }
-    const Move &getMove(size_t i) const {
+    const MoveOp &getMove(size_t i) const {
         return orderedMoves_[i];
     }
     bool hasCycles() const {
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index ae1984e96efc..c53edb5bf8c8 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1020,8 +1020,6 @@ CodeGeneratorARM::visitPowHalfD(LPowHalfD *ins)
     return true;
 }
 
-typedef MoveResolver::MoveOperand MoveOperand;
-
 MoveOperand
 CodeGeneratorARM::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/arm/CodeGenerator-arm.h b/js/src/jit/arm/CodeGenerator-arm.h
index a916315a485b..08c90dfd8920 100644
--- a/js/src/jit/arm/CodeGenerator-arm.h
+++ b/js/src/jit/arm/CodeGenerator-arm.h
@@ -43,7 +43,7 @@ class CodeGeneratorARM : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutFrom(Label *label, LSnapshot *snapshot);
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index fe039c5ec771..512aad71c061 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3518,26 +3518,26 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
             if (!from.isFloatReg() || from.floatReg() != fr) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), Move::DOUBLE);
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), MoveOp::DOUBLE);
             }
             // else nothing to do; the value is in the right register already
         } else {
             // If (and only if) the integer registers have started spilling, do we
             // need to take the double register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::DOUBLE);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
         }
         usedFloatSlots_++;
     } else {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
             if (!from.isGeneralReg() || from.reg() != r) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), Move::GENERAL);
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), MoveOp::GENERAL);
             }
             // else nothing to do; the value is in the right register already
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::GENERAL);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
         }
         usedIntSlots_++;
     }
@@ -3552,13 +3552,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    Move::Kind kind = Move::GENERAL;
+    MoveOp::Kind kind = MoveOp::GENERAL;
     if (from.isDouble()) {
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        kind = Move::DOUBLE;
+        kind = MoveOp::DOUBLE;
     }
 
     Register destReg;
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 9fb423cb43b1..ad0e79f2c58f 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -462,7 +462,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // Used to work around the move resolver's lack of support for
     // moving into register pairs, which the softfp ABI needs.
-    mozilla::Array<MoveResolver::MoveOperand, 2> floatArgsInGPR;
+    mozilla::Array<MoveOperand, 2> floatArgsInGPR;
     mozilla::Array<bool, 2> floatArgsInGPRValid;
 
     // Compute space needed for the function call and set the properties of the
@@ -485,9 +485,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     enum Result {
         GENERAL,
         DOUBLE,
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index 72fabee9a4e1..f5ded1122b99 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -100,7 +100,7 @@ MoveEmitterARM::tempReg()
 }
 
 void
-MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -108,7 +108,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move:
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -134,7 +134,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move:
 }
 
 void
-MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -142,7 +142,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -232,7 +232,7 @@ MoveEmitterARM::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
 }
 
 void
-MoveEmitterARM::emit(const Move &move)
+MoveEmitterARM::emit(const MoveOp &move)
 {
     const MoveOperand &from = move.from();
     const MoveOperand &to = move.to();
@@ -248,7 +248,7 @@ MoveEmitterARM::emit(const Move &move)
         inCycle_ = true;
     }
 
-    if (move.kind() == Move::DOUBLE)
+    if (move.kind() == MoveOp::DOUBLE)
         emitDoubleMove(from, to);
     else
         emitMove(from, to);
diff --git a/js/src/jit/arm/MoveEmitter-arm.h b/js/src/jit/arm/MoveEmitter-arm.h
index 049dc28fdf13..c1dca9f5f38f 100644
--- a/js/src/jit/arm/MoveEmitter-arm.h
+++ b/js/src/jit/arm/MoveEmitter-arm.h
@@ -17,9 +17,6 @@ class CodeGenerator;
 
 class MoveEmitterARM
 {
-    typedef MoveResolver::Move Move;
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     bool inCycle_;
     MacroAssemblerARMCompat &masm;
 
@@ -49,9 +46,9 @@ class MoveEmitterARM
 
     void emitMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
-    void completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
-    void emit(const Move &move);
+    void breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    void completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    void emit(const MoveOp &move);
 
   public:
     MoveEmitterARM(MacroAssemblerARMCompat &masm);
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 33478fb93f74..6a7291338d3f 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -654,8 +654,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
     VMWrapperMap::AddPtr p = functionWrappers_->lookupForAdd(&f);
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index e7a1fff0ccc7..2a563f422cac 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1329,8 +1329,6 @@ CodeGeneratorX86Shared::visitUrshD(LUrshD *ins)
     return true;
 }
 
-typedef MoveResolver::MoveOperand MoveOperand;
-
 MoveOperand
 CodeGeneratorX86Shared::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.h b/js/src/jit/shared/CodeGenerator-x86-shared.h
index 8525a41ab8dd..5ec76b33da0a 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.h
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.h
@@ -49,7 +49,7 @@ class CodeGeneratorX86Shared : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutIf(Assembler::DoubleCondition condition, LSnapshot *snapshot);
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 55ce862e0c6d..51ef2b76b73e 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -27,7 +27,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     size_t swapCount = 0;
 
     for (size_t j = i; ; j++) {
-        const Move &move = moves.getMove(j);
+        const MoveOp &move = moves.getMove(j);
 
         // If it isn't a cycle of registers of the same kind, we won't be able
         // to optimize it.
@@ -56,7 +56,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     }
 
     // Check that the last move cycles back to the first move.
-    const Move &move = moves.getMove(i + swapCount);
+    const MoveOp &move = moves.getMove(i + swapCount);
     if (move.from() != moves.getMove(i).to()) {
         *allGeneralRegs = false;
         *allFloatRegs = false;
@@ -99,7 +99,7 @@ void
 MoveEmitterX86::emit(const MoveResolver &moves)
 {
     for (size_t i = 0; i < moves.numMoves(); i++) {
-        const Move &move = moves.getMove(i);
+        const MoveOp &move = moves.getMove(i);
         const MoveOperand &from = move.from();
         const MoveOperand &to = move.to();
 
@@ -128,7 +128,7 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        if (move.kind() == Move::DOUBLE)
+        if (move.kind() == MoveOp::DOUBLE)
             emitDoubleMove(from, to);
         else
             emitGeneralMove(from, to);
@@ -204,7 +204,7 @@ MoveEmitterX86::toPopOperand(const MoveOperand &operand) const
 }
 
 void
-MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
+MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -212,7 +212,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
@@ -225,7 +225,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
 }
 
 void
-MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
+MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -233,7 +233,7 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.h b/js/src/jit/shared/MoveEmitter-x86-shared.h
index b7d8fe7446df..01636af4d063 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.h
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.h
@@ -23,9 +23,6 @@ class CodeGenerator;
 
 class MoveEmitterX86
 {
-    typedef MoveResolver::Move Move;
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     bool inCycle_;
     MacroAssemblerSpecific &masm;
 
@@ -48,8 +45,8 @@ class MoveEmitterX86
                                  bool allGeneralRegs, bool allFloatRegs, size_t swapCount);
     void emitGeneralMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &to, Move::Kind kind);
-    void completeCycle(const MoveOperand &to, Move::Kind kind);
+    void breakCycle(const MoveOperand &to, MoveOp::Kind kind);
+    void completeCycle(const MoveOperand &to, MoveOp::Kind kind);
 
   public:
     MoveEmitterX86(MacroAssemblerSpecific &masm);
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index 4586b3f01675..395a90955272 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -149,7 +149,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(double);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, Move::DOUBLE);
+        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
     } else {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
@@ -162,7 +162,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, Move::GENERAL);
+        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
     }
 }
 
@@ -264,7 +264,7 @@ MacroAssemblerX64::callWithABI(Address fun, Result result)
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
         // r10, a volatile, non-argument register.
-        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), Move::GENERAL);
+        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), MoveOp::GENERAL);
         fun.base = r10;
     }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index fc68f4ad9601..28f4eed9f6f8 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -85,9 +85,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
         FLOAT
     };
 
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index d41d42bea39d..14348720e429 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -503,8 +503,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index ace3e98d36af..c430c2778441 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -169,10 +169,10 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from)
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
     if (from.isDouble()) {
         stackForCall_ += sizeof(double);
-        enoughMemory_ &= moveResolver_.addMove(from, to, Move::DOUBLE);
+        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
     } else {
         stackForCall_ += sizeof(int32_t);
-        enoughMemory_ &= moveResolver_.addMove(from, to, Move::GENERAL);
+        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
     }
 }
 
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index 0d1395a08300..e7ee36481786 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -76,9 +76,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         FLOAT
     };
 
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index a14d8e2c2dfc..2c6558ccee22 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -538,8 +538,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());

From 371b48053374054a33428f21d3b39d5324474af9 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 049/144] Bug 949668 - SpiderMonkey: MoveOp cleanups. r=jandem

---
 js/src/jit/MoveResolver.h | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index bbe6f1201a32..3ae8a50fd053 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -125,16 +125,10 @@ class MoveOp
   public:
     MoveOp()
     { }
-    MoveOp(const MoveOp &other)
-      : from_(other.from_),
-        to_(other.to_),
-        cycle_(other.cycle_),
-        kind_(other.kind_)
-    { }
-    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind)
       : from_(from),
         to_(to),
-        cycle_(cycle),
+        cycle_(false),
         kind_(kind)
     { }
 
@@ -163,14 +157,13 @@ class MoveResolver
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : MoveOp(from, to, kind, false)
+          : MoveOp(from, to, kind)
         { }
-        
+
         void setInCycle() {
             JS_ASSERT(!inCycle());
             cycle_ = true;
         }
-
     };
 
     typedef InlineList<MoveResolver::PendingMove>::iterator PendingMoveIterator;

From 12ce37d8aa70f31130fa0288d356fc93ac2755f4 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 050/144] Bug 949668 - SpiderMonkey: Add an
 LDefinition::Float32 r=jandem

---
 js/src/jit/BacktrackingAllocator.cpp      |  4 +++-
 js/src/jit/LIR.cpp                        |  5 +++--
 js/src/jit/LIR.h                          |  6 ++++--
 js/src/jit/LinearScan.cpp                 |  6 ++++--
 js/src/jit/LiveRangeAllocator.cpp         |  1 +
 js/src/jit/LiveRangeAllocator.h           |  6 +++---
 js/src/jit/Lowering.cpp                   | 26 +++++++++++------------
 js/src/jit/RegisterAllocator.h            |  2 +-
 js/src/jit/StupidAllocator.cpp            |  6 ++++--
 js/src/jit/arm/Lowering-arm.cpp           |  2 +-
 js/src/jit/shared/Lowering-shared-inl.h   | 12 +++++++++--
 js/src/jit/shared/Lowering-shared.h       |  3 ++-
 js/src/jit/shared/Lowering-x86-shared.cpp |  6 +++---
 13 files changed, 52 insertions(+), 33 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 604f397b1ae9..f7b6ad07d6e7 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -1127,7 +1127,9 @@ BacktrackingAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL ||
+                             def->type() == LDefinition::FLOAT32 ||
+                             def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 9588b00bf6cd..e5bd77ca8986 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -196,10 +196,11 @@ static const char * const TypeChars[] =
 {
     "i",            // INTEGER
     "o",            // OBJECT
-    "f",            // DOUBLE
+    "f",            // FLOAT32
+    "d",            // DOUBLE
 #ifdef JS_NUNBOX32
     "t",            // TYPE
-    "d"             // PAYLOAD
+    "p"             // PAYLOAD
 #elif JS_PUNBOX64
     "x"             // BOX
 #endif
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 4f46e117a4d7..9b38d0d77637 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -446,7 +446,8 @@ class LDefinition
         GENERAL,    // Generic, integer or pointer-width data (GPR).
         OBJECT,     // Pointer that may be collected as garbage (GPR).
         SLOTS,      // Slots/elements pointer that may be moved by minor GCs (GPR).
-        DOUBLE,     // 64-bit point value (FPU).
+        FLOAT32,    // 32-bit floating-point value (FPU).
+        DOUBLE,     // 64-bit floating-point value (FPU).
 #ifdef JS_NUNBOX32
         // A type virtual register must be followed by a payload virtual
         // register, as both will be tracked as a single gcthing.
@@ -540,8 +541,9 @@ class LDefinition
           case MIRType_Object:
             return LDefinition::OBJECT;
           case MIRType_Double:
-          case MIRType_Float32:
             return LDefinition::DOUBLE;
+          case MIRType_Float32:
+            return LDefinition::FLOAT32;
 #if defined(JS_PUNBOX64)
           case MIRType_Value:
             return LDefinition::BOX;
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index cd22f4d36818..86731c3ece01 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -515,7 +515,9 @@ LinearScanAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL ||
+                             def->type() == LDefinition::FLOAT32 ||
+                             def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
@@ -792,7 +794,7 @@ LinearScanAllocator::allocateSlotFor(const LiveInterval *interval)
     LinearScanVirtualRegister *reg = &vregs[interval->vreg()];
 
     SlotList *freed;
-    if (reg->type() == LDefinition::DOUBLE)
+    if (reg->type() == LDefinition::DOUBLE || reg->type() == LDefinition::FLOAT32)
         freed = &finishedDoubleSlots_;
 #ifdef JS_NUNBOX32
     else if (IsNunbox(reg))
diff --git a/js/src/jit/LiveRangeAllocator.cpp b/js/src/jit/LiveRangeAllocator.cpp
index 361fdb60ebcd..0d457286657e 100644
--- a/js/src/jit/LiveRangeAllocator.cpp
+++ b/js/src/jit/LiveRangeAllocator.cpp
@@ -468,6 +468,7 @@ AddRegisterToSafepoint(LSafepoint *safepoint, AnyRegister reg, const LDefinition
 
     JS_ASSERT(def.type() == LDefinition::GENERAL ||
               def.type() == LDefinition::DOUBLE ||
+              def.type() == LDefinition::FLOAT32 ||
               def.type() == LDefinition::OBJECT);
 
     if (def.type() == LDefinition::OBJECT)
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index a469ebda4aeb..cfff988c4163 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -136,7 +136,7 @@ static inline bool
 DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation alloc)
 {
     if (ins->isPhi()) {
-        if (def->type() == LDefinition::DOUBLE)
+        if (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
             return alloc.isFloatReg() || alloc.kind() == LAllocation::DOUBLE_SLOT;
         return alloc.isGeneralReg() || alloc.kind() == LAllocation::STACK_SLOT;
     }
@@ -145,7 +145,7 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::DEFAULT:
         if (!alloc.isRegister())
             return false;
-        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE);
+        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32);
       case LDefinition::PRESET:
         return alloc == *def->output();
       case LDefinition::MUST_REUSE_INPUT:
@@ -473,7 +473,7 @@ class VirtualRegister
         return intervals_.insert(found, interval);
     }
     bool isDouble() const {
-        return def_->type() == LDefinition::DOUBLE;
+        return def_->type() == LDefinition::DOUBLE || def_->type() == LDefinition::FLOAT32;
     }
 
     LiveInterval *intervalFor(CodePosition pos);
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 54b3a02c0a76..875ae3b7ff1e 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -659,7 +659,7 @@ LIRGenerator::visitTest(MTest *test)
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
-        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
+        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempDouble(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
@@ -1026,7 +1026,7 @@ LIRGenerator::visitTypeOf(MTypeOf *ins)
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
-    LToIdV *lir = new(alloc()) LToIdV(tempFloat());
+    LToIdV *lir = new(alloc()) LToIdV(tempDouble());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
@@ -1175,7 +1175,7 @@ bool
 LIRGenerator::visitRound(MRound *ins)
 {
     JS_ASSERT(ins->num()->type() == MIRType_Double);
-    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempFloat());
+    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempDouble());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
@@ -1754,7 +1754,7 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
@@ -1799,7 +1799,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
@@ -2025,7 +2025,7 @@ LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 
     LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
                                                                     useRegisterAtStart(ins->value()),
-                                                                    tempFloat());
+                                                                    tempDouble());
     return defineBox(lir, ins);
 }
 
@@ -2342,7 +2342,7 @@ LIRGenerator::visitNot(MNot *ins)
             temp1 = LDefinition::BogusTemp();
         }
 
-        LNotV *lir = new(alloc()) LNotV(tempFloat(), temp0, temp1);
+        LNotV *lir = new(alloc()) LNotV(tempDouble(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
@@ -2625,7 +2625,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 
       case MIRType_Value:
       {
-        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempFloat());
+        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempDouble());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
@@ -2912,15 +2912,15 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       case MIRType_Double:
-        lir = new(alloc()) LAssertRangeD(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
         break;
 
       case MIRType_Float32:
-        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat32());
         break;
 
       case MIRType_Value:
-        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
+        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempDouble(), tempDouble());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
@@ -3026,7 +3026,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
-                                             temp(), tempFloat());
+                                             temp(), tempDouble());
 
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
@@ -3035,7 +3035,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     } else {
         lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
                                              useRegisterOrConstant(ins->value()),
-                                             tempToUnbox(), temp(), tempFloat());
+                                             tempToUnbox(), temp(), tempDouble());
 
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
diff --git a/js/src/jit/RegisterAllocator.h b/js/src/jit/RegisterAllocator.h
index e6059eaef31d..f5f0d2770cfd 100644
--- a/js/src/jit/RegisterAllocator.h
+++ b/js/src/jit/RegisterAllocator.h
@@ -369,7 +369,7 @@ class RegisterAllocator
 static inline AnyRegister
 GetFixedRegister(const LDefinition *def, const LUse *use)
 {
-    return def->type() == LDefinition::DOUBLE
+    return (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
            ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
            : AnyRegister(Register::FromCode(use->registerCode()));
 }
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 921bdf9d08d4..9c350555d9cc 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -28,7 +28,9 @@ StupidAllocator::stackLocation(uint32_t vreg)
     if (def->policy() == LDefinition::PRESET && def->output()->isArgument())
         return def->output();
 
-    return new(alloc()) LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
+    return new(alloc()) LStackSlot(DefaultStackSlot(vreg),
+                                   def->type() == LDefinition::DOUBLE ||
+                                   def->type() == LDefinition::FLOAT32);
 }
 
 StupidAllocator::RegisterIndex
@@ -162,7 +164,7 @@ StupidAllocator::allocateRegister(LInstruction *ins, uint32_t vreg)
     for (size_t i = 0; i < registerCount; i++) {
         AnyRegister reg = registers[i].reg;
 
-        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE))
+        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32))
             continue;
 
         // Skip the register if it is in use for an allocated input or output.
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index 8f4ca0c78d19..b74971f3e3f6 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -362,7 +362,7 @@ LIRGeneratorARM::newLTableSwitch(const LAllocation &in, const LDefinition &input
 LTableSwitchV *
 LIRGeneratorARM::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempFloat(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempDouble(), tableswitch);
 }
 
 bool
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index 940d346cae9d..fcc6fdc68ca7 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -149,12 +149,14 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
 #endif
         break;
       case MIRType_Float32:
+        lir->setDef(0, LDefinition(vreg, LDefinition::FLOAT32, LFloatReg(ReturnFloatReg)));
+        break;
       case MIRType_Double:
         lir->setDef(0, LDefinition(vreg, LDefinition::DOUBLE, LFloatReg(ReturnFloatReg)));
         break;
       default:
         LDefinition::Type type = LDefinition::TypeFrom(mir->type());
-        JS_ASSERT(type != LDefinition::DOUBLE);
+        JS_ASSERT(type != LDefinition::DOUBLE && type != LDefinition::FLOAT32);
         lir->setDef(0, LDefinition(vreg, type, LGeneralReg(ReturnReg)));
         break;
     }
@@ -421,7 +423,13 @@ LIRGeneratorShared::tempFixed(Register reg)
 }
 
 LDefinition
-LIRGeneratorShared::tempFloat()
+LIRGeneratorShared::tempFloat32()
+{
+    return temp(LDefinition::FLOAT32);
+}
+
+LDefinition
+LIRGeneratorShared::tempDouble()
 {
     return temp(LDefinition::DOUBLE);
 }
diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
index fdfb74276682..35075335af13 100644
--- a/js/src/jit/shared/Lowering-shared.h
+++ b/js/src/jit/shared/Lowering-shared.h
@@ -104,7 +104,8 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
     // These create temporary register requests.
     inline LDefinition temp(LDefinition::Type type = LDefinition::GENERAL,
                             LDefinition::Policy policy = LDefinition::DEFAULT);
-    inline LDefinition tempFloat();
+    inline LDefinition tempFloat32();
+    inline LDefinition tempDouble();
     inline LDefinition tempCopy(MDefinition *input, uint32_t reusedInput);
 
     // Note that the fixed register has a GENERAL type.
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 8895dba562bc..71d687543dfa 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -27,7 +27,7 @@ LIRGeneratorX86Shared::newLTableSwitch(const LAllocation &in, const LDefinition
 LTableSwitchV *
 LIRGeneratorX86Shared::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempDouble(), temp(), tableswitch);
 }
 
 bool
@@ -333,7 +333,7 @@ LIRGeneratorX86Shared::lowerTruncateDToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempDouble();
     return define(new(alloc()) LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
 }
 
@@ -343,6 +343,6 @@ LIRGeneratorX86Shared::lowerTruncateFToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat32();
     return define(new(alloc()) LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
 }

From e55bd88d090603b1aa5f8272cf572b71a4de9a04 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 051/144] Bug 949668 - SpiderMonkey: Add a type to LMoveGroup.
 r=jandem

---
 js/src/jit/BacktrackingAllocator.cpp | 15 +++++++-------
 js/src/jit/LIR-Common.h              | 13 +++++++++----
 js/src/jit/LIR.cpp                   | 10 +++++-----
 js/src/jit/LinearScan.cpp            | 29 +++++++++++++++-------------
 js/src/jit/LinearScan.h              |  2 +-
 js/src/jit/LiveRangeAllocator.h      | 20 +++++++++----------
 js/src/jit/StupidAllocator.cpp       | 17 +++++++++-------
 js/src/jit/StupidAllocator.h         |  5 ++++-
 8 files changed, 63 insertions(+), 48 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index f7b6ad07d6e7..bd601cc0a884 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -917,10 +917,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                 LiveInterval *prevInterval = reg->intervalFor(start.previous());
                 if (start.subpos() == CodePosition::INPUT) {
-                    if (!moveInput(inputOf(data->ins()), prevInterval, interval))
+                    if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
                         return false;
                 } else {
-                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
+                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
                         return false;
                 }
             }
@@ -940,7 +940,8 @@ BacktrackingAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            VirtualRegister *vreg = &vregs[phi->getDef(0)];
+            LDefinition *def = phi->getDef(0);
+            VirtualRegister *vreg = &vregs[def];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -952,7 +953,7 @@ BacktrackingAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to))
+                if (!moveAtExit(predecessor, from, to, def->type()))
                     return false;
             }
         }
@@ -977,10 +978,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                     if (mSuccessor->numPredecessors() > 1) {
                         JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                        if (!moveAtExit(predecessor, from, to))
+                        if (!moveAtExit(predecessor, from, to, reg.type()))
                             return false;
                     } else {
-                        if (!moveAtEntry(successor, from, to))
+                        if (!moveAtEntry(successor, from, to, reg.type()))
                             return false;
                     }
                 }
@@ -1076,7 +1077,7 @@ BacktrackingAllocator::reifyAllocations()
 
                     if (*res != *alloc) {
                         LMoveGroup *group = getInputMoveGroup(inputOf(ins));
-                        if (!group->addAfter(sourceAlloc, res))
+                        if (!group->addAfter(sourceAlloc, res, def->type()))
                             return false;
                         *alloc = *res;
                     }
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 8f94028624a1..c4d11cee87e2 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -71,11 +71,13 @@ class LMove
 {
     LAllocation *from_;
     LAllocation *to_;
+    LDefinition::Type type_;
 
   public:
-    LMove(LAllocation *from, LAllocation *to)
+    LMove(LAllocation *from, LAllocation *to, LDefinition::Type type)
       : from_(from),
-        to_(to)
+        to_(to),
+        type_(type)
     { }
 
     LAllocation *from() {
@@ -90,6 +92,9 @@ class LMove
     const LAllocation *to() const {
         return to_;
     }
+    LDefinition::Type type() const {
+        return type_;
+    }
 };
 
 class LMoveGroup : public LInstructionHelper<0, 0, 0>
@@ -110,10 +115,10 @@ class LMoveGroup : public LInstructionHelper<0, 0, 0>
     void printOperands(FILE *fp);
 
     // Add a move which takes place simultaneously with all others in the group.
-    bool add(LAllocation *from, LAllocation *to);
+    bool add(LAllocation *from, LAllocation *to, LDefinition::Type type);
 
     // Add a move which takes place after existing moves in the group.
-    bool addAfter(LAllocation *from, LAllocation *to);
+    bool addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type);
 
     size_t numMoves() const {
         return moves_.length();
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index e5bd77ca8986..114a6724841e 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -363,18 +363,18 @@ LInstruction::initSafepoint(TempAllocator &alloc)
 }
 
 bool
-LMoveGroup::add(LAllocation *from, LAllocation *to)
+LMoveGroup::add(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
 #ifdef DEBUG
     JS_ASSERT(*from != *to);
     for (size_t i = 0; i < moves_.length(); i++)
         JS_ASSERT(*to != *moves_[i].to());
 #endif
-    return moves_.append(LMove(from, to));
+    return moves_.append(LMove(from, to, type));
 }
 
 bool
-LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
+LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
     // Transform the operands to this move so that performing the result
     // simultaneously with existing moves in the group will have the same
@@ -392,12 +392,12 @@ LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
 
     for (size_t i = 0; i < moves_.length(); i++) {
         if (*to == *moves_[i].to()) {
-            moves_[i] = LMove(from, to);
+            moves_[i] = LMove(from, to, type);
             return true;
         }
     }
 
-    return add(from, to);
+    return add(from, to, type);
 }
 
 void
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index 86731c3ece01..6a46531ab37b 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -233,7 +233,8 @@ LinearScanAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LinearScanVirtualRegister *vreg = &vregs[phi->getDef(0)];
+            LDefinition *def = phi->getDef(0);
+            LinearScanVirtualRegister *vreg = &vregs[def];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -245,14 +246,15 @@ LinearScanAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to))
+                if (!moveAtExit(predecessor, from, to, def->type()))
                     return false;
             }
 
             if (vreg->mustSpillAtDefinition() && !to->isSpill()) {
                 // Make sure this phi is spilled at the loop header.
                 LMoveGroup *moves = successor->getEntryMoveGroup(alloc());
-                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill()))
+                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill(),
+                                def->type()))
                     return false;
             }
         }
@@ -283,10 +285,10 @@ LinearScanAllocator::resolveControlFlow()
 
                 if (mSuccessor->numPredecessors() > 1) {
                     JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                    if (!moveAtExit(predecessor, from, to))
+                    if (!moveAtExit(predecessor, from, to, vreg->type()))
                         return false;
                 } else {
-                    if (!moveAtEntry(successor, from, to))
+                    if (!moveAtEntry(successor, from, to, vreg->type()))
                         return false;
                 }
             }
@@ -297,12 +299,13 @@ LinearScanAllocator::resolveControlFlow()
 }
 
 bool
-LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to)
+LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to,
+                                    LDefinition::Type type)
 {
     if (*from == *to)
         return true;
     LMoveGroup *moves = getInputMoveGroup(pos);
-    return moves->add(from, to);
+    return moves->add(from, to, type);
 }
 
 static inline void
@@ -350,7 +353,7 @@ LinearScanAllocator::reifyAllocations()
                 LiveInterval *to = fixedIntervals[GetFixedRegister(reg->def(), usePos->use).code()];
 
                 *static_cast<LAllocation *>(usePos->use) = *to->getAllocation();
-                if (!moveInput(usePos->pos, interval, to))
+                if (!moveInput(usePos->pos, interval, to, reg->type()))
                     return false;
             } else {
                 JS_ASSERT(UseCompatibleWith(usePos->use, *interval->getAllocation()));
@@ -376,7 +379,7 @@ LinearScanAllocator::reifyAllocations()
                 // it should use the fixed register instead.
                 SetOsiPointUses(interval, defEnd, LAllocation(fixedReg));
 
-                if (!moveAfter(defEnd, from, interval))
+                if (!moveAfter(defEnd, from, interval, def->type()))
                     return false;
                 spillFrom = from->getAllocation();
             } else {
@@ -387,7 +390,7 @@ LinearScanAllocator::reifyAllocations()
                     JS_ASSERT(!inputAlloc->isUse());
 
                     *inputAlloc = *interval->getAllocation();
-                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc))
+                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc, def->type()))
                         return false;
                 }
 
@@ -417,7 +420,7 @@ LinearScanAllocator::reifyAllocations()
                 // or Nop instructions). Note that we explicitly ignore phis,
                 // which should have been handled in resolveControlFlow().
                 LMoveGroup *moves = getMoveGroupAfter(defEnd);
-                if (!moves->add(spillFrom, reg->canonicalSpill()))
+                if (!moves->add(spillFrom, reg->canonicalSpill(), def->type()))
                     return false;
             }
         }
@@ -443,10 +446,10 @@ LinearScanAllocator::reifyAllocations()
             JS_ASSERT(start == inputOf(data->ins()) || start == outputOf(data->ins()));
 
             if (start.subpos() == CodePosition::INPUT) {
-                if (!moveInput(inputOf(data->ins()), prevInterval, interval))
+                if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
                     return false;
             } else {
-                if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
+                if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
                     return false;
             }
 
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index 64ce47d9191a..cf194b9e20b9 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -111,7 +111,7 @@ class LinearScanAllocator
     AnyRegister::Code findBestFreeRegister(CodePosition *freeUntil);
     AnyRegister::Code findBestBlockedRegister(CodePosition *nextUsed);
     bool canCoexist(LiveInterval *a, LiveInterval *b);
-    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to);
+    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to, LDefinition::Type type);
     void setIntervalRequirement(LiveInterval *interval);
     bool isSpilledAt(LiveInterval *interval, CodePosition pos);
 
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index cfff988c4163..993f1c495451 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -633,37 +633,37 @@ class LiveRangeAllocator : protected RegisterAllocator
     }
 #endif
 
-    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to) {
+    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         JS_ASSERT(*from->getAllocation() != *to->getAllocation());
-        return moves->add(from->getAllocation(), to->getAllocation());
+        return moves->add(from->getAllocation(), to->getAllocation(), type);
     }
 
-    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to) {
+    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getInputMoveGroup(pos);
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to) {
+    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getMoveGroupAfter(pos);
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to) {
+    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getExitMoveGroup(alloc());
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to) {
+    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getEntryMoveGroup(alloc());
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
     size_t findFirstNonCallSafepoint(CodePosition from) const
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 9c350555d9cc..8f9751faba72 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -143,7 +143,7 @@ StupidAllocator::ensureHasRegister(LInstruction *ins, uint32_t vreg)
     }
 
     RegisterIndex best = allocateRegister(ins, vreg);
-    loadRegister(ins, vreg, best);
+    loadRegister(ins, vreg, best, virtualRegisters[vreg]->type());
 
     return registers[best].reg;
 }
@@ -192,7 +192,7 @@ StupidAllocator::syncRegister(LInstruction *ins, RegisterIndex index)
 
         uint32_t existing = registers[index].vreg;
         LAllocation *dest = stackLocation(existing);
-        input->addAfter(source, dest);
+        input->addAfter(source, dest, registers[index].type);
 
         registers[index].dirty = false;
     }
@@ -206,14 +206,15 @@ StupidAllocator::evictRegister(LInstruction *ins, RegisterIndex index)
 }
 
 void
-StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index)
+StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type)
 {
     // Load a vreg from its stack location to a register.
     LMoveGroup *input = getInputMoveGroup(ins->id());
     LAllocation *source = stackLocation(vreg);
     LAllocation *dest = new(alloc()) LAllocation(registers[index].reg);
-    input->addAfter(source, dest);
+    input->addAfter(source, dest, type);
     registers[index].set(vreg, ins);
+    registers[index].type = type;
 }
 
 StupidAllocator::RegisterIndex
@@ -312,7 +313,7 @@ StupidAllocator::syncForBlockEnd(LBlock *block, LInstruction *ins)
                 }
             }
 
-            group->add(source, dest);
+            group->add(source, dest, phi->getDef(0)->type());
         }
     }
 }
@@ -336,14 +337,14 @@ StupidAllocator::allocateForInstruction(LInstruction *ins)
             AnyRegister reg = ensureHasRegister(ins, vreg);
             alloc.replace(LAllocation(reg));
         } else if (use->policy() == LUse::FIXED) {
-            AnyRegister reg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
+            AnyRegister reg = GetFixedRegister(virtualRegisters[vreg], use);
             RegisterIndex index = registerIndex(reg);
             if (registers[index].vreg != vreg) {
                 evictRegister(ins, index);
                 RegisterIndex existing = findExistingRegister(vreg);
                 if (existing != UINT32_MAX)
                     evictRegister(ins, existing);
-                loadRegister(ins, vreg, index);
+                loadRegister(ins, vreg, index, virtualRegisters[vreg]->type());
             }
             alloc.replace(LAllocation(reg));
         } else {
@@ -409,6 +410,7 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
                           : ins->getOperand(def->getReusedInput())->toRegister());
         evictRegister(ins, index);
         registers[index].set(vreg, ins, true);
+        registers[index].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[index].reg));
     } else if (def->policy() == LDefinition::PRESET) {
         // The result must be a stack location.
@@ -417,6 +419,7 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
         // Find a register to hold the result of the instruction.
         RegisterIndex best = allocateRegister(ins, vreg);
         registers[best].set(vreg, ins, true);
+        registers[best].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[best].reg));
     }
 }
diff --git a/js/src/jit/StupidAllocator.h b/js/src/jit/StupidAllocator.h
index f48befa0ff8b..e7891b65a264 100644
--- a/js/src/jit/StupidAllocator.h
+++ b/js/src/jit/StupidAllocator.h
@@ -22,6 +22,9 @@ class StupidAllocator : public RegisterAllocator
     struct AllocatedRegister {
         AnyRegister reg;
 
+        // The type of the value in the register.
+        LDefinition::Type type;
+
         // Virtual register this physical reg backs, or MISSING_ALLOCATION.
         uint32_t vreg;
 
@@ -72,7 +75,7 @@ class StupidAllocator : public RegisterAllocator
 
     void syncRegister(LInstruction *ins, RegisterIndex index);
     void evictRegister(LInstruction *ins, RegisterIndex index);
-    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index);
+    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type);
 
     RegisterIndex findExistingRegister(uint32_t vreg);
 

From cf80b63f425d81d156dc2a1847acc945b6de84bb Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 052/144] Bug 949668 - SpiderMonkey: Delete an unused function.
 r=jandem

---
 js/src/jit/LIR.h | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 9b38d0d77637..15baf7bee34e 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -363,10 +363,6 @@ class LStackSlot : public LAllocation
       : LAllocation(isDouble ? DOUBLE_SLOT : STACK_SLOT, slot)
     { }
 
-    bool isDouble() const {
-        return kind() == DOUBLE_SLOT;
-    }
-
     uint32_t slot() const {
         return data();
     }

From d6a58ddb0bbcc9fe95568cbcc90112cce73fb16d Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 053/144] Bug 949668 - SpiderMonkey: Enum simplification.
 r=jandem

---
 js/src/jit/BaselineIC.cpp                    | 10 ++--
 js/src/jit/CodeGenerator.cpp                 | 59 ++++++++++++--------
 js/src/jit/IonMacroAssembler.h               |  4 +-
 js/src/jit/MoveResolver.h                    | 39 +++++++------
 js/src/jit/arm/MacroAssembler-arm.cpp        | 49 +++++++++-------
 js/src/jit/arm/MacroAssembler-arm.h          | 18 ++----
 js/src/jit/arm/MoveEmitter-arm.cpp           |  6 +-
 js/src/jit/arm/Trampoline-arm.cpp            |  8 +--
 js/src/jit/shared/CodeGenerator-shared.cpp   |  2 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp |  4 +-
 js/src/jit/x64/MacroAssembler-x64.cpp        | 32 +++++++----
 js/src/jit/x64/MacroAssembler-x64.h          | 18 ++----
 js/src/jit/x64/Trampoline-x64.cpp            | 37 ++++++------
 js/src/jit/x86/CodeGenerator-x86.cpp         |  4 +-
 js/src/jit/x86/MacroAssembler-x86.cpp        | 29 ++++++----
 js/src/jit/x86/MacroAssembler-x86.h          | 18 ++----
 js/src/jit/x86/Trampoline-x86.cpp            | 50 ++++++++---------
 17 files changed, 204 insertions(+), 183 deletions(-)

diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index e12f63ccfe7c..d6a5177a6081 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2841,9 +2841,9 @@ ICBinaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
         break;
       case JSOP_MOD:
         masm.setupUnalignedABICall(2, R0.scratchReg());
-        masm.passABIArg(FloatReg0);
-        masm.passABIArg(FloatReg1);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
+        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg1, MoveOp::DOUBLE);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
         JS_ASSERT(ReturnFloatReg == FloatReg0);
         break;
       default:
@@ -2968,7 +2968,7 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.bind(&truncateABICall);
         masm.push(intReg);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0);
+        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
         masm.pop(intReg);
@@ -3117,7 +3117,7 @@ ICUnaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
 
         masm.bind(&truncateABICall);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0);
+        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index b6fac075a84a..6a03835e0605 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mnde: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1177,13 +1177,28 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
 
         const LAllocation *from = move.from();
         const LAllocation *to = move.to();
+        LDefinition::Type type = move.type();
 
         // No bogus moves.
         JS_ASSERT(*from != *to);
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveOp::Kind kind = from->isDouble() ? MoveOp::DOUBLE : MoveOp::GENERAL;
+        MoveOp::Kind kind;
+        switch (type) {
+          case LDefinition::OBJECT:
+          case LDefinition::SLOTS:
+#ifdef JS_NUNBOX32
+          case LDefinition::TYPE:
+          case LDefinition::PAYLOAD:
+#else
+          case LDefinition::BOX:
+#endif
+          case LDefinition::GENERAL: kind = MoveOp::GENERAL; break;
+          case LDefinition::FLOAT32:
+          case LDefinition::DOUBLE:  kind = MoveOp::DOUBLE;  break;
+          default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
+        }
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
@@ -3035,9 +3050,9 @@ bool CodeGenerator::visitAtan2D(LAtan2D *lir)
     FloatRegister x = ToFloatRegister(lir->x());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(y);
-    masm.passABIArg(x);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MacroAssembler::DOUBLE);
+    masm.passABIArg(y, MoveOp::DOUBLE);
+    masm.passABIArg(x, MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3050,9 +3065,9 @@ bool CodeGenerator::visitHypot(LHypot *lir)
     FloatRegister y = ToFloatRegister(lir->y());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(x);
-    masm.passABIArg(y);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MacroAssembler::DOUBLE);
+    masm.passABIArg(x, MoveOp::DOUBLE);
+    masm.passABIArg(y, MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3791,10 +3806,10 @@ CodeGenerator::visitPowI(LPowI *ins)
     // its scratch register. We can therefore save an input register by
     // reusing the scratch register to pass constants to callWithABI.
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value);
+    masm.passABIArg(value, MoveOp::DOUBLE);
     masm.passABIArg(power);
 
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MacroAssembler::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MoveOp::DOUBLE);
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     return true;
@@ -3808,9 +3823,9 @@ CodeGenerator::visitPowD(LPowD *ins)
     Register temp = ToRegister(ins->temp());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value);
-    masm.passABIArg(power);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MacroAssembler::DOUBLE);
+    masm.passABIArg(value, MoveOp::DOUBLE);
+    masm.passABIArg(power, MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3826,7 +3841,7 @@ CodeGenerator::visitRandom(LRandom *ins)
 
     masm.setupUnalignedABICall(1, temp2);
     masm.passABIArg(temp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MacroAssembler::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3846,7 +3861,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         masm.movePtr(ImmPtr(mathCache), temp);
         masm.passABIArg(temp);
     }
-    masm.passABIArg(input);
+    masm.passABIArg(input, MoveOp::DOUBLE);
 
 #   define MAYBE_CACHED(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
 
@@ -3927,7 +3942,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
 
 #   undef MAYBE_CACHED
 
-    masm.callWithABI(funptr, MacroAssembler::DOUBLE);
+    masm.callWithABI(funptr, MoveOp::DOUBLE);
     return true;
 }
 
@@ -3939,7 +3954,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(1, temp);
-    masm.passABIArg(input);
+    masm.passABIArg(input, MoveOp::DOUBLE);
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
@@ -3956,7 +3971,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MacroAssembler::FLOAT);
+    masm.callWithABI(funptr, MoveOp::DOUBLE);
     return true;
 }
 
@@ -3970,13 +3985,13 @@ CodeGenerator::visitModD(LModD *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(lhs);
-    masm.passABIArg(rhs);
+    masm.passABIArg(lhs, MoveOp::DOUBLE);
+    masm.passABIArg(rhs, MoveOp::DOUBLE);
 
     if (gen->compilingAsmJS())
-        masm.callWithABI(AsmJSImm_ModD, MacroAssembler::DOUBLE);
+        masm.callWithABI(AsmJSImm_ModD, MoveOp::DOUBLE);
     else
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
     return true;
 }
 
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 4a03191b8973..297c1c3bb654 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -865,12 +865,12 @@ class MacroAssembler : public MacroAssemblerSpecific
     // been made so that a safepoint can be made at that location.
 
     template <typename T>
-    void callWithABINoProfiling(const T &fun, Result result = GENERAL) {
+    void callWithABINoProfiling(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
         MacroAssemblerSpecific::callWithABI(fun, result);
     }
 
     template <typename T>
-    void callWithABI(const T &fun, Result result = GENERAL) {
+    void callWithABI(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
         leaveSPSFrame();
         callWithABINoProfiling(fun, result);
         reenterSPSFrame();
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 3ae8a50fd053..099125b57f3d 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -18,38 +18,39 @@ namespace jit {
 // guaranteed that Operand looks like this on all ISAs.
 class MoveOperand
 {
+  public:
     enum Kind {
+        // A register in the "integer", aka "general purpose", class.
         REG,
+        // A register in the "float" register class.
         FLOAT_REG,
-        ADDRESS,
-        FLOAT_ADDRESS,
+        // A memory region.
+        MEMORY,
+        // The address of a memory region.
         EFFECTIVE_ADDRESS
     };
 
+  private:
     Kind kind_;
     uint32_t code_;
     int32_t disp_;
 
   public:
-    enum AddressKind {
-        MEMORY = ADDRESS,
-        EFFECTIVE = EFFECTIVE_ADDRESS,
-        FLOAT = FLOAT_ADDRESS
-    };
-
     MoveOperand()
     { }
     explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
     { }
     explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
     { }
-    MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
-        : kind_((Kind) addrKind),
+    MoveOperand(const Register &reg, int32_t disp, Kind kind = MEMORY)
+        : kind_(kind),
         code_(reg.code()),
         disp_(disp)
     {
+        JS_ASSERT(isMemoryOrEffectiveAddress());
+
         // With a zero offset, this is a plain reg-to-reg move.
-        if (disp == 0 && addrKind == EFFECTIVE)
+        if (disp == 0 && kind_ == EFFECTIVE_ADDRESS)
             kind_ = REG;
     }
     MoveOperand(const MoveOperand &other)
@@ -63,18 +64,15 @@ class MoveOperand
     bool isGeneralReg() const {
         return kind_ == REG;
     }
-    bool isDouble() const {
-        return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
-    }
     bool isMemory() const {
-        return kind_ == ADDRESS;
-    }
-    bool isFloatAddress() const {
-        return kind_ == FLOAT_ADDRESS;
+        return kind_ == MEMORY;
     }
     bool isEffectiveAddress() const {
         return kind_ == EFFECTIVE_ADDRESS;
     }
+    bool isMemoryOrEffectiveAddress() const {
+        return isMemory() || isEffectiveAddress();
+    }
     Register reg() const {
         JS_ASSERT(isGeneralReg());
         return Register::FromCode(code_);
@@ -84,10 +82,11 @@ class MoveOperand
         return FloatRegister::FromCode(code_);
     }
     Register base() const {
-        JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+        JS_ASSERT(isMemoryOrEffectiveAddress());
         return Register::FromCode(code_);
     }
     int32_t disp() const {
+        JS_ASSERT(isMemoryOrEffectiveAddress());
         return disp_;
     }
 
@@ -96,7 +95,7 @@ class MoveOperand
             return false;
         if (code_ != other.code_)
             return false;
-        if (isMemory() || isEffectiveAddress())
+        if (isMemoryOrEffectiveAddress())
             return disp_ == other.disp_;
         return true;
     }
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 512aad71c061..a8bc75f6f74d 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3508,13 +3508,14 @@ MacroAssemblerARMCompat::setupUnalignedABICall(uint32_t args, const Register &sc
 }
 #ifdef JS_CPU_ARM_HARDFP
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
     ++passedArgs_;
     if (!enoughMemory_)
         return;
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE: {
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
             if (!from.isFloatReg() || from.floatReg() != fr) {
@@ -3528,7 +3529,9 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
             enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
         }
         usedFloatSlots_++;
-    } else {
+        break;
+      }
+      case MoveOp::GENERAL: {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
             if (!from.isGeneralReg() || from.reg() != r) {
@@ -3540,31 +3543,39 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
             enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
         }
         usedIntSlots_++;
+        break;
+      }
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
 }
 
 #else
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    MoveOp::Kind kind = MoveOp::GENERAL;
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE:
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        kind = MoveOp::DOUBLE;
+        break;
+      case MoveOp::GENERAL:
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
     Register destReg;
     MoveOperand dest;
     if (GetIntArgReg(usedSlots_, 0, &destReg)) {
-        if (from.isDouble()) {
+        if (kind == MoveOp::DOUBLE) {
             floatArgsInGPR[destReg.code() >> 1] = from;
             floatArgsInGPRValid[destReg.code() >> 1] = true;
             useResolver = false;
@@ -3588,13 +3599,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
 void
 MacroAssemblerARMCompat::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
 }
 
 void
-MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg)
+MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg, MoveOp::Kind kind)
 {
-    passABIArg(MoveOperand(freg));
+    passABIArg(MoveOperand(freg), kind);
 }
 
 void MacroAssemblerARMCompat::checkStackAlignment()
@@ -3642,7 +3653,7 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
             if (from.isFloatReg()) {
                 ma_vxfer(VFPRegister(from.floatReg()), to0, to1);
             } else {
-                JS_ASSERT(from.isFloatAddress());
+                JS_ASSERT(from.isMemory());
                 // Note: We can safely use the MoveOperand's displacement here,
                 // even if the base is SP: MoveEmitter::toOperand adjusts
                 // SP-relative operands by the difference between the current
@@ -3664,25 +3675,25 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, Result result)
+MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 {
     if (secondScratchReg_ != lr)
         ma_mov(secondScratchReg_, lr);
 
     switch (result) {
-      case DOUBLE:
+      case MoveOp::DOUBLE:
 #ifndef JS_CPU_ARM_HARDFP
         // Move double from r0/r1 to ReturnFloatReg.
         as_vxfer(r0, r1, ReturnFloatReg, CoreToFloat);
         break;
 #endif
-      case FLOAT:
+      case MoveOp::FLOAT32:
 #ifndef JS_CPU_ARM_HARDFP
         // Move float32 from r0 to ReturnFloatReg.
         as_vxfer(r0, InvalidReg, VFPRegister(d0).singleOverlay(), CoreToFloat);
         break;
 #endif
-      case GENERAL:
+      case MoveOp::GENERAL:
         break;
 
       default:
@@ -3702,7 +3713,7 @@ MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, Result result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(void *fun, Result result)
+MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3711,7 +3722,7 @@ MacroAssemblerARMCompat::callWithABI(void *fun, Result result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, Result result)
+MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3720,7 +3731,7 @@ MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, Result result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(const Address &fun, Result result)
+MacroAssemblerARMCompat::callWithABI(const Address &fun, MoveOp::Kind result)
 {
     // Load the callee in r12, no instruction between the ldr and call
     // should clobber it. Note that we can't use fun.base because it may
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index ad0e79f2c58f..91612e990896 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -485,12 +485,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
-    enum Result {
-        GENERAL,
-        DOUBLE,
-        FLOAT
-    };
-
     MacroAssemblerARMCompat()
       : inCall_(false),
         enoughMemory_(true),
@@ -1409,9 +1403,9 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from);
+    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg);
+    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
     void passABIArg(const ValueOperand &regs);
 
   protected:
@@ -1419,13 +1413,13 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, Result result);
+    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, Result result = GENERAL);
-    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
-    void callWithABI(const Address &fun, Result result = GENERAL);
+    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
 
     CodeOffsetLabel labelForPatch() {
         return CodeOffsetLabel(nextOffset().getOffset());
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index f5ded1122b99..c7543d7e9543 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -58,7 +58,7 @@ MoveEmitterARM::spillSlot() const
 Operand
 MoveEmitterARM::toOperand(const MoveOperand &operand, bool isFloat) const
 {
-    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress()) {
+    if (operand.isMemoryOrEffectiveAddress()) {
         if (operand.base() != StackPointer) {
             JS_ASSERT(operand.disp() < 1024 && operand.disp() > -1024);
             return Operand(operand.base(), operand.disp());
@@ -193,7 +193,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
             MOZ_ASSUME_UNREACHABLE("strange move!");
         }
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
+        JS_ASSERT(from.isMemoryOrEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), to.reg());
         else
@@ -202,7 +202,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
         // Memory to memory gpr move.
         Register reg = tempReg();
 
-        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
+        JS_ASSERT(from.isMemoryOrEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), reg);
         else
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 6a7291338d3f..a53d0d02dd9d 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -735,22 +735,22 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         MoveOperand from;
         switch (f.argProperties(explicitArg)) {
           case VMFunction::WordByValue:
-            masm.passABIArg(MoveOperand(argsBase, argDisp));
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByValue:
             // Values should be passed by reference, not by value, so we
             // assert that the argument is a double-precision float.
             JS_ASSERT(f.argPassedInFloatReg(explicitArg));
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
             argDisp += sizeof(double);
             break;
           case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
             argDisp += 2 * sizeof(void *);
             break;
         }
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index bb6aecb62e36..410af5d2b062 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -768,7 +768,7 @@ CodeGeneratorShared::visitOutOfLineTruncateSlow(OutOfLineTruncateSlow *ool)
     }
 
     masm.setupUnalignedABICall(1, dest);
-    masm.passABIArg(src);
+    masm.passABIArg(src, MoveOp::DOUBLE);
     if (gen->compilingAsmJS())
         masm.callWithABI(AsmJSImm_ToInt32);
     else
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 51ef2b76b73e..0054a2c0e718 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -170,7 +170,7 @@ MoveEmitterX86::toAddress(const MoveOperand &operand) const
 Operand
 MoveEmitterX86::toOperand(const MoveOperand &operand) const
 {
-    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress())
+    if (operand.isMemoryOrEffectiveAddress())
         return Operand(toAddress(operand));
     if (operand.isGeneralReg())
         return Operand(operand.reg());
@@ -255,7 +255,7 @@ MoveEmitterX86::emitGeneralMove(const MoveOperand &from, const MoveOperand &to)
     if (from.isGeneralReg()) {
         masm.mov(from.reg(), toOperand(to));
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
+        JS_ASSERT(from.isMemoryOrEffectiveAddress());
         if (from.isMemory())
             masm.loadPtr(toAddress(from), to.reg());
         else
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index 395a90955272..e9591858bfe8 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -134,10 +134,11 @@ MacroAssemblerX64::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX64::passABIArg(const MoveOperand &from)
+MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE: {
         FloatRegister dest;
         if (GetFloatArgReg(passedIntArgs_, passedFloatArgs_++, &dest)) {
             if (from.isFloatReg() && from.floatReg() == dest) {
@@ -147,10 +148,15 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(dest);
         } else {
             to = MoveOperand(StackPointer, stackForCall_);
-            stackForCall_ += sizeof(double);
+            switch (kind) {
+              case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
+              default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument kind");
+            }
         }
         enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
-    } else {
+        break;
+      }
+      case MoveOp::GENERAL: {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
             if (from.isGeneralReg() && from.reg() == dest) {
@@ -163,19 +169,23 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             stackForCall_ += sizeof(int64_t);
         }
         enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
+        break;
+      }
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 }
 
 void
 MacroAssemblerX64::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
 }
 
 void
-MacroAssemblerX64::passABIArg(const FloatRegister &reg)
+MacroAssemblerX64::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), kind);
 }
 
 void
@@ -219,7 +229,7 @@ MacroAssemblerX64::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, Result result)
+MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 {
     freeStack(stackAdjust);
     if (dynamicAlignment_)
@@ -230,7 +240,7 @@ MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, Result result)
 }
 
 void
-MacroAssemblerX64::callWithABI(void *fun, Result result)
+MacroAssemblerX64::callWithABI(void *fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -239,7 +249,7 @@ MacroAssemblerX64::callWithABI(void *fun, Result result)
 }
 
 void
-MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, Result result)
+MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -259,7 +269,7 @@ IsIntArgReg(Register reg)
 }
 
 void
-MacroAssemblerX64::callWithABI(Address fun, Result result)
+MacroAssemblerX64::callWithABI(Address fun, MoveOp::Kind result)
 {
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index 28f4eed9f6f8..d8bd8b36d077 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -79,12 +79,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
-    enum Result {
-        GENERAL,
-        DOUBLE,
-        FLOAT
-    };
-
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
@@ -1199,19 +1193,19 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from);
+    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg);
+    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, Result result);
+    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, Result result = GENERAL);
-    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
-    void callWithABI(Address fun, Result result = GENERAL);
+    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(Address fun, MoveOp::Kind result = MoveOp::GENERAL);
 
     void handleFailureWithHandler(void *handler);
     void handleFailureWithHandlerTail();
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 14348720e429..0ebc99a01326 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -586,25 +586,24 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    if (f.explicitArgs) {
-        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-            MoveOperand from;
-            switch (f.argProperties(explicitArg)) {
-              case VMFunction::WordByValue:
-                if (f.argPassedInFloatReg(explicitArg))
-                    masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
-                else
-                    masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::WordByRef:
-                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::DoubleByValue:
-              case VMFunction::DoubleByRef:
-                MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
-            }
+    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+        MoveOperand from;
+        switch (f.argProperties(explicitArg)) {
+          case VMFunction::WordByValue:
+            if (f.argPassedInFloatReg(explicitArg))
+                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
+            else
+                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::WordByRef:
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
+                            MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::DoubleByValue:
+          case VMFunction::DoubleByRef:
+            MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
         }
     }
 
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 534518ff2eaa..48914c71a1fd 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -900,7 +900,7 @@ CodeGeneratorX86::visitOutOfLineTruncate(OutOfLineTruncate *ool)
         saveVolatile(output);
 
         masm.setupUnalignedABICall(1, output);
-        masm.passABIArg(input);
+        masm.passABIArg(input, MoveOp::DOUBLE);
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
         else
@@ -991,7 +991,7 @@ CodeGeneratorX86::visitOutOfLineTruncateFloat32(OutOfLineTruncateFloat32 *ool)
         masm.push(input);
         masm.setupUnalignedABICall(1, output);
         masm.cvtss2sd(input, input);
-        masm.passABIArg(input);
+        masm.passABIArg(input, MoveOp::DOUBLE);
 
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index c430c2778441..3a1629fe45d9 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -163,29 +163,34 @@ MacroAssemblerX86::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX86::passABIArg(const MoveOperand &from)
+MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     ++passedArgs_;
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE:
         stackForCall_ += sizeof(double);
         enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
-    } else {
+        break;
+      case MoveOp::GENERAL:
         stackForCall_ += sizeof(int32_t);
         enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 }
 
 void
 MacroAssemblerX86::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
 }
 
 void
-MacroAssemblerX86::passABIArg(const FloatRegister &reg)
+MacroAssemblerX86::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), kind);
 }
 
 void
@@ -230,16 +235,16 @@ MacroAssemblerX86::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, Result result)
+MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 {
     freeStack(stackAdjust);
-    if (result == DOUBLE) {
+    if (result == MoveOp::DOUBLE) {
         reserveStack(sizeof(double));
         fstp(Operand(esp, 0));
         loadDouble(Operand(esp, 0), ReturnFloatReg);
         freeStack(sizeof(double));
     }
-    if (result == FLOAT) {
+    if (result == MoveOp::FLOAT32) {
         reserveStack(sizeof(float));
         fstp32(Operand(esp, 0));
         loadFloat(Operand(esp, 0), ReturnFloatReg);
@@ -253,7 +258,7 @@ MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, Result result)
 }
 
 void
-MacroAssemblerX86::callWithABI(void *fun, Result result)
+MacroAssemblerX86::callWithABI(void *fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -262,7 +267,7 @@ MacroAssemblerX86::callWithABI(void *fun, Result result)
 }
 
 void
-MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, Result result)
+MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -271,7 +276,7 @@ MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, Result result)
 }
 
 void
-MacroAssemblerX86::callWithABI(const Address &fun, Result result)
+MacroAssemblerX86::callWithABI(const Address &fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index e7ee36481786..eb4a64cb8ae7 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -70,12 +70,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
-    enum Result {
-        GENERAL,
-        DOUBLE,
-        FLOAT
-    };
-
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
@@ -1043,19 +1037,19 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from);
+    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg);
+    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, Result result);
+    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, Result result = GENERAL);
-    void callWithABI(AsmJSImmPtr fun, Result result = GENERAL);
-    void callWithABI(const Address &fun, Result result = GENERAL);
+    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(AsmJSImmPtr fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
 
     // Used from within an Exit frame to handle a pending exception.
     void handleFailureWithHandler(void *handler);
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 2c6558ccee22..6b584b6cbfc1 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -614,31 +614,31 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    if (f.explicitArgs) {
-        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-            MoveOperand from;
-            switch (f.argProperties(explicitArg)) {
-              case VMFunction::WordByValue:
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::DoubleByValue:
-                // We don't pass doubles in float registers on x86, so no need
-                // to check for argPassedInFloatReg.
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::WordByRef:
-                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::DoubleByRef:
-                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
-                argDisp += 2 * sizeof(void *);
-                break;
-            }
+    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+        MoveOperand from;
+        switch (f.argProperties(explicitArg)) {
+          case VMFunction::WordByValue:
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::DoubleByValue:
+            // We don't pass doubles in float registers on x86, so no need
+            // to check for argPassedInFloatReg.
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::WordByRef:
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
+                            MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::DoubleByRef:
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
+                            MoveOp::GENERAL);
+            argDisp += 2 * sizeof(void *);
+            break;
         }
     }
 

From 18f4be66a837a5df5accfd6aef845712fd5233d4 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 054/144] Bug 949668 - SpiderMonkey: Add a MoveOp::FLOAT32
 r=jandem

---
 js/src/jit/CodeGenerator.cpp                 |  6 ++--
 js/src/jit/MoveResolver.h                    |  1 +
 js/src/jit/arm/Assembler-arm.h               | 12 +++++++-
 js/src/jit/arm/MacroAssembler-arm.cpp        | 25 +++++++++-------
 js/src/jit/arm/MoveEmitter-arm.cpp           | 31 ++++++++++++++++----
 js/src/jit/shared/MoveEmitter-x86-shared.cpp | 31 ++++++++++++++++----
 js/src/jit/x64/MacroAssembler-x64.cpp        |  6 ++--
 js/src/jit/x86/MacroAssembler-x86.cpp        | 18 ++++--------
 8 files changed, 90 insertions(+), 40 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 6a03835e0605..9f27af7b3c79 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1195,7 +1195,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
           case LDefinition::BOX:
 #endif
           case LDefinition::GENERAL: kind = MoveOp::GENERAL; break;
-          case LDefinition::FLOAT32:
+          case LDefinition::FLOAT32: kind = MoveOp::FLOAT32; break;
           case LDefinition::DOUBLE:  kind = MoveOp::DOUBLE;  break;
           default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
         }
@@ -3954,7 +3954,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(1, temp);
-    masm.passABIArg(input, MoveOp::DOUBLE);
+    masm.passABIArg(input, MoveOp::FLOAT32);
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
@@ -3971,7 +3971,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MoveOp::DOUBLE);
+    masm.callWithABI(funptr, MoveOp::FLOAT32);
     return true;
 }
 
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 099125b57f3d..acb1492051d6 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -115,6 +115,7 @@ class MoveOp
   public:
     enum Kind {
         GENERAL,
+        FLOAT32,
         DOUBLE
     };
 
diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index 362d7d183470..9c5107672729 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -2152,9 +2152,19 @@ GetIntArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *paddi
 }
 
 static inline uint32_t
-GetFloatArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
+GetFloat32ArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
 {
+    JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
+    uint32_t intSlots = 0;
+    if (usedIntArgs > NumIntArgRegs)
+        intSlots = usedIntArgs - NumIntArgRegs;
+    uint32_t float32Slots = usedFloatArgs - NumFloatArgRegs;
+    return (intSlots + float32Slots + *padding) * STACK_SLOT_SIZE;
+}
 
+static inline uint32_t
+GetDoubleArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
+{
     JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
     uint32_t intSlots = 0;
     if (usedIntArgs > NumIntArgRegs) {
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index a8bc75f6f74d..64fbbf5b9f23 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3515,18 +3515,20 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
     if (!enoughMemory_)
         return;
     switch (kind) {
+      case MoveOp::FLOAT32:
       case MoveOp::DOUBLE: {
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
-            if (!from.isFloatReg() || from.floatReg() != fr) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), MoveOp::DOUBLE);
+            if (from.isFloatReg() && from.floatReg() == fr) {
+                // Nothing to do; the value is in the right register already
+                return;
             }
-            // else nothing to do; the value is in the right register already
+            to = MoveOperand(fr);
         } else {
             // If (and only if) the integer registers have started spilling, do we
-            // need to take the double register's alignment into account
+            // need to take the register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
+            to = MoveOperand(sp, disp);
         }
         usedFloatSlots_++;
         break;
@@ -3534,13 +3536,14 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
       case MoveOp::GENERAL: {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
-            if (!from.isGeneralReg() || from.reg() != r) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), MoveOp::GENERAL);
+            if (from.isGeneralReg() && from.reg() == r) {
+                // Nothing to do; the value is in the right register already
+                return;
             }
-            // else nothing to do; the value is in the right register already
+            to = MoveOperand(r);
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
+            to = MoveOperand(sp, disp);
         }
         usedIntSlots_++;
         break;
@@ -3549,6 +3552,7 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
         MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
+    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 #else
@@ -3566,6 +3570,7 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
         break;
+      case MoveOp::FLOAT32:
       case MoveOp::GENERAL:
         break;
       default:
@@ -3575,7 +3580,7 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
     Register destReg;
     MoveOperand dest;
     if (GetIntArgReg(usedSlots_, 0, &destReg)) {
-        if (kind == MoveOp::DOUBLE) {
+        if (kind == MoveOp::DOUBLE || kind == MoveOp::FLOAT32) {
             floatArgsInGPR[destReg.code() >> 1] = from;
             floatArgsInGPRValid[destReg.code() >> 1] = true;
             useResolver = false;
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index c7543d7e9543..549d9f6e1a05 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -108,7 +108,9 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -116,7 +118,8 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
         } else {
             masm.ma_vstr(to.floatReg(), cycleSlot());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         // an non-vfp value
         if (to.isMemory()) {
             Register temp = tempReg();
@@ -130,6 +133,9 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
             }
             masm.ma_str(to.reg(), cycleSlot());
         }
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -142,7 +148,9 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -150,7 +158,8 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
         } else {
             masm.ma_vldr(cycleSlot(), to.floatReg());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         if (to.isMemory()) {
             Register temp = tempReg();
             masm.ma_ldr(cycleSlot(), temp);
@@ -162,6 +171,9 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
             }
             masm.ma_ldr(cycleSlot(), to.reg());
         }
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -248,10 +260,17 @@ MoveEmitterARM::emit(const MoveOp &move)
         inCycle_ = true;
     }
 
-    if (move.kind() == MoveOp::DOUBLE)
+    switch (move.kind()) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         emitDoubleMove(from, to);
-    else
+        break;
+      case MoveOp::GENERAL:
         emitMove(from, to);
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
+    }
 }
 
 void
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 0054a2c0e718..597926d11770 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -128,10 +128,17 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        if (move.kind() == MoveOp::DOUBLE)
+        switch (move.kind()) {
+          case MoveOp::FLOAT32:
+          case MoveOp::DOUBLE:
             emitDoubleMove(from, to);
-        else
+            break;
+          case MoveOp::GENERAL:
             emitGeneralMove(from, to);
+            break;
+          default:
+            MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
+        }
     }
 }
 
@@ -212,15 +219,21 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
         } else {
             masm.storeDouble(to.floatReg(), cycleSlot());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         masm.Push(toOperand(to));
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -233,19 +246,25 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
         } else {
             masm.loadDouble(cycleSlot(), to.floatReg());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         if (to.isMemory()) {
             masm.Pop(toPopOperand(to));
         } else {
             masm.Pop(to.reg());
         }
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index e9591858bfe8..db522ee87ed4 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -138,6 +138,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
     switch (kind) {
+      case MoveOp::FLOAT32:
       case MoveOp::DOUBLE: {
         FloatRegister dest;
         if (GetFloatArgReg(passedIntArgs_, passedFloatArgs_++, &dest)) {
@@ -149,11 +150,11 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
         } else {
             to = MoveOperand(StackPointer, stackForCall_);
             switch (kind) {
+              case MoveOp::FLOAT32: stackForCall_ += sizeof(float);  break;
               case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
               default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument kind");
             }
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
         break;
       }
       case MoveOp::GENERAL: {
@@ -168,12 +169,13 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
         break;
       }
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
+
+    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 void
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index 3a1629fe45d9..a4b00cdc27fb 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -168,17 +168,12 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
     ++passedArgs_;
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
     switch (kind) {
-      case MoveOp::DOUBLE:
-        stackForCall_ += sizeof(double);
-        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
-        break;
-      case MoveOp::GENERAL:
-        stackForCall_ += sizeof(int32_t);
-        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+      case MoveOp::FLOAT32: stackForCall_ += sizeof(float); break;
+      case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
+      case MoveOp::GENERAL: stackForCall_ += sizeof(int32_t); break;
+      default: MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
+    enoughMemory_ &= moveResolver_.addMove(from, to, kind);
 }
 
 void
@@ -243,8 +238,7 @@ MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
         fstp(Operand(esp, 0));
         loadDouble(Operand(esp, 0), ReturnFloatReg);
         freeStack(sizeof(double));
-    }
-    if (result == MoveOp::FLOAT32) {
+    } else if (result == MoveOp::FLOAT32) {
         reserveStack(sizeof(float));
         fstp32(Operand(esp, 0));
         loadFloat(Operand(esp, 0), ReturnFloatReg);

From accec5413439fa92818b2a8b7c6f1e50fa115db6 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 055/144] Bug 949171 - SpiderMonkey: Pad the local slot size by
 at least sizeof(Value). r=nbp

---
 js/src/jit/LIR.h                           | 21 +++++++++++++++++++--
 js/src/jit/shared/CodeGenerator-shared.cpp |  3 +--
 js/src/jit/shared/CodeGenerator-shared.h   | 11 ++++++-----
 3 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 15baf7bee34e..20ad0db4317d 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -1394,7 +1394,20 @@ class LIRGraph
         localSlotCount_ = localSlotCount;
     }
     uint32_t localSlotCount() const {
-        return AlignBytes(localSlotCount_, StackAlignment / STACK_SLOT_SIZE);
+        return localSlotCount_;
+    }
+    // Return the localSlotCount() value rounded up so that it satisfies the
+    // platform stack alignment requirement, and so that it's a multiple of
+    // the number of slots per Value.
+    uint32_t paddedLocalSlotCount() const {
+        // Round to StackAlignment, but also round to at least sizeof(Value) in
+        // case that's greater, because StackOffsetOfPassedArg rounds argument
+        // slots to 8-byte boundaries.
+        size_t Alignment = Max(sizeof(StackAlignment), sizeof(Value));
+        return AlignBytes(localSlotCount(), Alignment / STACK_SLOT_SIZE);
+    }
+    size_t paddedLocalSlotsSize() const {
+        return paddedLocalSlotCount() * STACK_SLOT_SIZE;
     }
     void setArgumentSlotCount(uint32_t argumentSlotCount) {
         argumentSlotCount_ = argumentSlotCount;
@@ -1402,8 +1415,12 @@ class LIRGraph
     uint32_t argumentSlotCount() const {
         return argumentSlotCount_;
     }
+    size_t argumentsSize() const {
+        JS_STATIC_ASSERT(sizeof(Value) >= size_t(STACK_SLOT_SIZE));
+        return argumentSlotCount() * sizeof(Value);
+    }
     uint32_t totalSlotCount() const {
-        return localSlotCount() + (argumentSlotCount() * sizeof(Value) / STACK_SLOT_SIZE);
+        return paddedLocalSlotCount() + (argumentsSize() / STACK_SLOT_SIZE);
     }
     bool addConstantToPool(const Value &v, uint32_t *index);
     size_t numConstants() const {
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index 410af5d2b062..4441b399e9a7 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -49,8 +49,7 @@ CodeGeneratorShared::CodeGeneratorShared(MIRGenerator *gen, LIRGraph *graph, Mac
     sps_(&GetIonContext()->runtime->spsProfiler(), &lastPC_),
     osrEntryOffset_(0),
     skipArgCheckEntryOffset_(0),
-    frameDepth_(graph->localSlotCount() * sizeof(STACK_SLOT_SIZE) +
-                graph->argumentSlotCount() * sizeof(Value))
+    frameDepth_(graph->paddedLocalSlotsSize() + graph->argumentsSize())
 {
     if (!gen->compilingAsmJS())
         masm.setInstrumentation(&sps_);
diff --git a/js/src/jit/shared/CodeGenerator-shared.h b/js/src/jit/shared/CodeGenerator-shared.h
index f2bc4f82d894..f174640cf459 100644
--- a/js/src/jit/shared/CodeGenerator-shared.h
+++ b/js/src/jit/shared/CodeGenerator-shared.h
@@ -170,16 +170,17 @@ class CodeGeneratorShared : public LInstructionVisitor
         // A slot of 0 is permitted only to calculate %esp offset for calls.
         JS_ASSERT(slot >= 0 && slot <= int32_t(graph.argumentSlotCount()));
         int32_t offset = masm.framePushed() -
-                       (graph.localSlotCount() * STACK_SLOT_SIZE) -
+                       graph.paddedLocalSlotsSize() -
                        (slot * sizeof(Value));
+
         // Passed arguments go below A function's local stack storage.
         // When arguments are being pushed, there is nothing important on the stack.
         // Therefore, It is safe to push the arguments down arbitrarily.  Pushing
-        // by 8 is desirable since everything on the stack is a Value, which is 8
-        // bytes large.
-
-        offset &= ~7;
+        // by sizeof(Value) is desirable since everything on the stack is a Value.
+        // Note that paddedLocalSlotCount() aligns to at least a Value boundary
+        // specifically to support this.
         JS_ASSERT(offset >= 0);
+        JS_ASSERT(offset % sizeof(Value) == 0);
         return offset;
     }
 

From bf65a5665cb0cd2a61969a29c17b9dda7015712e Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 056/144] Bug 949171 - IonMonkey: Use the right block for
 EffectiveAddressAnalysis r=nbp

---
 js/src/jit/EffectiveAddressAnalysis.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/js/src/jit/EffectiveAddressAnalysis.cpp b/js/src/jit/EffectiveAddressAnalysis.cpp
index 698696f97367..207e23a60467 100644
--- a/js/src/jit/EffectiveAddressAnalysis.cpp
+++ b/js/src/jit/EffectiveAddressAnalysis.cpp
@@ -12,7 +12,7 @@ using namespace js;
 using namespace jit;
 
 static void
-AnalyzeLsh(TempAllocator &alloc, MBasicBlock *block, MLsh *lsh)
+AnalyzeLsh(TempAllocator &alloc, MLsh *lsh)
 {
     if (lsh->specialization() != MIRType_Int32)
         return;
@@ -86,7 +86,7 @@ AnalyzeLsh(TempAllocator &alloc, MBasicBlock *block, MLsh *lsh)
 
     MEffectiveAddress *eaddr = MEffectiveAddress::New(alloc, base, index, scale, displacement);
     last->replaceAllUsesWith(eaddr);
-    block->insertAfter(last, eaddr);
+    last->block()->insertAfter(last, eaddr);
 }
 
 // This analysis converts patterns of the form:
@@ -109,7 +109,7 @@ EffectiveAddressAnalysis::analyze()
     for (ReversePostorderIterator block(graph_.rpoBegin()); block != graph_.rpoEnd(); block++) {
         for (MInstructionIterator i = block->begin(); i != block->end(); i++) {
             if (i->isLsh())
-                AnalyzeLsh(graph_.alloc(), *block, i->toLsh());
+                AnalyzeLsh(graph_.alloc(), i->toLsh());
         }
     }
     return true;

From 9f4e4d2fefa7cb85a36104ab82f2c0a412db1209 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 057/144] Bug 949171 - SpiderMonkey: Tighten up various
 assertions. r=nbp

---
 js/src/jit/BacktrackingAllocator.cpp |  1 +
 js/src/jit/BitSet.h                  | 12 ++++++------
 js/src/jit/CodeGenerator.cpp         | 12 ++++++++++--
 js/src/jit/LIR.cpp                   |  5 +++--
 js/src/jit/Lowering.cpp              |  1 +
 js/src/jit/MIR.h                     |  1 +
 js/src/jit/MIRGraph.cpp              |  2 ++
 js/src/jit/RangeAnalysis.cpp         |  2 +-
 8 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index bd601cc0a884..803079fc2879 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -835,6 +835,7 @@ BacktrackingAllocator::spill(LiveInterval *interval)
     IonSpew(IonSpew_RegAlloc, "Spilling interval");
 
     JS_ASSERT(interval->requirement()->kind() == Requirement::NONE);
+    JS_ASSERT(!interval->getAllocation()->isStackSlot());
 
     // We can't spill bogus intervals.
     JS_ASSERT(interval->hasVreg());
diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index 730557be1efb..4135c346ad38 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -58,7 +58,7 @@ class BitSet : private TempObject
     // O(1): Check if this set contains the given value.
     bool contains(unsigned int value) const {
         JS_ASSERT(bits_);
-        JS_ASSERT(value <= max_);
+        JS_ASSERT(value < max_);
 
         return !!(bits_[wordForValue(value)] & bitForValue(value));
     }
@@ -69,7 +69,7 @@ class BitSet : private TempObject
     // O(1): Insert the given value into this set.
     void insert(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value <= max_);
+        JS_ASSERT(value < max_);
 
         bits_[wordForValue(value)] |= bitForValue(value);
     }
@@ -80,7 +80,7 @@ class BitSet : private TempObject
     // O(1): Remove the given value from this set.
     void remove(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value <= max_);
+        JS_ASSERT(value < max_);
 
         bits_[wordForValue(value)] &= ~bitForValue(value);
     }
@@ -137,7 +137,7 @@ class BitSet::Iterator
 
     inline Iterator& operator++(int dummy) {
         JS_ASSERT(more());
-        JS_ASSERT(index_ <= set_.max_);
+        JS_ASSERT(index_ < set_.max_);
 
         index_++;
         value_ >>= 1;
@@ -158,12 +158,12 @@ class BitSet::Iterator
         index_ += numZeros;
         value_ >>= numZeros;
 
-        JS_ASSERT_IF(index_ <= set_.max_, set_.contains(index_));
+        JS_ASSERT_IF(index_ < set_.max_, set_.contains(index_));
         return *this;
     }
 
     unsigned int operator *() {
-        JS_ASSERT(index_ <= set_.max_);
+        JS_ASSERT(index_ < set_.max_);
         return index_;
     }
 };
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 9f27af7b3c79..f0c05f4ed83b 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1139,6 +1139,7 @@ CodeGenerator::visitStackArgT(LStackArgT *lir)
     const LAllocation *arg = lir->getArgument();
     MIRType argType = lir->mir()->getArgument()->type();
     uint32_t argslot = lir->argslot();
+    JS_ASSERT(argslot - 1u < graph.argumentSlotCount());
 
     int32_t stack_offset = StackOffsetOfPassedArg(argslot);
     Address dest(StackPointer, stack_offset);
@@ -1150,7 +1151,9 @@ CodeGenerator::visitStackArgT(LStackArgT *lir)
     else
         masm.storeValue(*(arg->toConstant()), dest);
 
-    return pushedArgumentSlots_.append(StackOffsetToSlot(stack_offset));
+    uint32_t slot = StackOffsetToSlot(stack_offset);
+    JS_ASSERT(slot - 1u < graph.totalSlotCount());
+    return pushedArgumentSlots_.append(slot);
 }
 
 bool
@@ -1158,10 +1161,15 @@ CodeGenerator::visitStackArgV(LStackArgV *lir)
 {
     ValueOperand val = ToValue(lir, 0);
     uint32_t argslot = lir->argslot();
+    JS_ASSERT(argslot - 1u < graph.argumentSlotCount());
+
     int32_t stack_offset = StackOffsetOfPassedArg(argslot);
 
     masm.storeValue(val, Address(StackPointer, stack_offset));
-    return pushedArgumentSlots_.append(StackOffsetToSlot(stack_offset));
+
+    uint32_t slot = StackOffsetToSlot(stack_offset);
+    JS_ASSERT(slot - 1u < graph.totalSlotCount());
+    return pushedArgumentSlots_.append(slot);
 }
 
 bool
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 114a6724841e..7fef35f37b2f 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -73,8 +73,9 @@ LBlock::lastId()
 {
     LInstruction *last = *instructions_.rbegin();
     JS_ASSERT(last->id());
-    if (last->numDefs())
-        return last->getDef(last->numDefs() - 1)->virtualRegister();
+    // The last instruction is a control flow instruction which does not have
+    // any output.
+    JS_ASSERT(last->numDefs() == 0);
     return last->id();
 }
 
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 875ae3b7ff1e..5f0b099ba712 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -305,6 +305,7 @@ LIRGenerator::visitPassArg(MPassArg *arg)
 {
     MDefinition *opd = arg->getArgument();
     uint32_t argslot = getArgumentSlot(arg->getArgnum());
+    JS_ASSERT(arg->getArgnum() < prepareCallStack_.back()->argc());
 
     // Pass through the virtual register of the operand.
     // This causes snapshots to correctly copy the operand on the stack.
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 97207eed77b7..3eff668f0e5a 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2829,6 +2829,7 @@ class MPassArg
     // Set by the MCall.
     void setArgnum(uint32_t argnum) {
         argnum_ = argnum;
+        JS_ASSERT(argnum_ >= 0);
     }
     uint32_t getArgnum() const {
         JS_ASSERT(argnum_ >= 0);
diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
index ac4034f6a536..96fb758b3016 100644
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -763,6 +763,7 @@ MBasicBlock::discardAllResumePoints(bool discardEntry)
 void
 MBasicBlock::insertBefore(MInstruction *at, MInstruction *ins)
 {
+    JS_ASSERT(at->block() == this);
     ins->setBlock(this);
     graph().allocDefinitionId(ins);
     instructions_.insertBefore(at, ins);
@@ -772,6 +773,7 @@ MBasicBlock::insertBefore(MInstruction *at, MInstruction *ins)
 void
 MBasicBlock::insertAfter(MInstruction *at, MInstruction *ins)
 {
+    JS_ASSERT(at->block() == this);
     ins->setBlock(this);
     graph().allocDefinitionId(ins);
     instructions_.insertAfter(at, ins);
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index a60f4ca555a1..bef8925e1d0a 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -994,7 +994,7 @@ MPhi::computeRange(TempAllocator &alloc)
         return;
 
     Range *range = nullptr;
-    JS_ASSERT(getOperand(0)->op() != MDefinition::Op_OsrValue);
+    JS_ASSERT(!isOSRLikeValue(getOperand(0)));
     for (size_t i = 0, e = numOperands(); i < e; i++) {
         if (getOperand(i)->block()->unreachable()) {
             IonSpew(IonSpew_Range, "Ignoring unreachable input %d", getOperand(i)->id());

From 2607a0f9638a03520f94f5b3b57de18f09a168de Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 058/144] Bug 949171 - SpiderMonkey: Rename bitset's max to
 numBits. r=nbp

---
 js/src/jit/BitSet.cpp | 12 ++++++------
 js/src/jit/BitSet.h   | 43 ++++++++++++++++++++++---------------------
 2 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/js/src/jit/BitSet.cpp b/js/src/jit/BitSet.cpp
index c320ac8574e4..df5fe4846eae 100644
--- a/js/src/jit/BitSet.cpp
+++ b/js/src/jit/BitSet.cpp
@@ -10,9 +10,9 @@ using namespace js;
 using namespace js::jit;
 
 BitSet *
-BitSet::New(TempAllocator &alloc, unsigned int max)
+BitSet::New(TempAllocator &alloc, unsigned int numBits)
 {
-    BitSet *result = new(alloc) BitSet(max);
+    BitSet *result = new(alloc) BitSet(numBits);
     if (!result->init(alloc))
         return nullptr;
     return result;
@@ -47,7 +47,7 @@ void
 BitSet::insertAll(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     for (unsigned int i = 0; i < numWords(); i++)
@@ -58,7 +58,7 @@ void
 BitSet::removeAll(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     for (unsigned int i = 0; i < numWords(); i++)
@@ -69,7 +69,7 @@ void
 BitSet::intersect(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     for (unsigned int i = 0; i < numWords(); i++)
@@ -81,7 +81,7 @@ bool
 BitSet::fixedPointIntersect(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     bool changed = false;
diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index 4135c346ad38..434b2bac5a77 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -16,7 +16,8 @@ namespace jit {
 
 // Provides constant time set insertion and removal, and fast linear
 // set operations such as intersection, difference, and union.
-// N.B. All set operations must be performed on sets with the same maximum.
+// N.B. All set operations must be performed on sets with the same number
+// of bits.
 class BitSet : private TempObject
 {
   public:
@@ -25,11 +26,11 @@ class BitSet : private TempObject
     }
 
   private:
-    BitSet(unsigned int max) :
-        max_(max),
+    BitSet(unsigned int numBits) :
+        numBits_(numBits),
         bits_(nullptr) {}
 
-    unsigned int max_;
+    unsigned int numBits_;
     uint32_t *bits_;
 
     static inline uint32_t bitForValue(unsigned int value) {
@@ -41,7 +42,7 @@ class BitSet : private TempObject
     }
 
     inline unsigned int numWords() const {
-        return RawLengthForBits(max_);
+        return RawLengthForBits(numBits_);
     }
 
     bool init(TempAllocator &alloc);
@@ -49,56 +50,56 @@ class BitSet : private TempObject
   public:
     class Iterator;
 
-    static BitSet *New(TempAllocator &alloc, unsigned int max);
+    static BitSet *New(TempAllocator &alloc, unsigned int numBits);
 
-    unsigned int getMax() const {
-        return max_;
+    unsigned int getNumBits() const {
+        return numBits_;
     }
 
     // O(1): Check if this set contains the given value.
     bool contains(unsigned int value) const {
         JS_ASSERT(bits_);
-        JS_ASSERT(value < max_);
+        JS_ASSERT(value < numBits_);
 
         return !!(bits_[wordForValue(value)] & bitForValue(value));
     }
 
-    // O(max): Check if this set contains any value.
+    // O(numBits): Check if this set contains any value.
     bool empty() const;
 
     // O(1): Insert the given value into this set.
     void insert(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value < max_);
+        JS_ASSERT(value < numBits_);
 
         bits_[wordForValue(value)] |= bitForValue(value);
     }
 
-    // O(max): Insert every element of the given set into this set.
+    // O(numBits): Insert every element of the given set into this set.
     void insertAll(const BitSet *other);
 
     // O(1): Remove the given value from this set.
     void remove(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value < max_);
+        JS_ASSERT(value < numBits_);
 
         bits_[wordForValue(value)] &= ~bitForValue(value);
     }
 
-    // O(max): Remove the every element of the given set from this set.
+    // O(numBits): Remove the every element of the given set from this set.
     void removeAll(const BitSet *other);
 
-    // O(max): Intersect this set with the given set.
+    // O(numBits): Intersect this set with the given set.
     void intersect(const BitSet *other);
 
-    // O(max): Intersect this set with the given set; return whether the
+    // O(numBits): Intersect this set with the given set; return whether the
     // intersection caused the set to change.
     bool fixedPointIntersect(const BitSet *other);
 
-    // O(max): Does inplace complement of the set.
+    // O(numBits): Does inplace complement of the set.
     void complement();
 
-    // O(max): Clear this set.
+    // O(numBits): Clear this set.
     void clear();
 
     uint32_t *raw() const {
@@ -137,7 +138,7 @@ class BitSet::Iterator
 
     inline Iterator& operator++(int dummy) {
         JS_ASSERT(more());
-        JS_ASSERT(index_ < set_.max_);
+        JS_ASSERT(index_ < set_.numBits_);
 
         index_++;
         value_ >>= 1;
@@ -158,12 +159,12 @@ class BitSet::Iterator
         index_ += numZeros;
         value_ >>= numZeros;
 
-        JS_ASSERT_IF(index_ < set_.max_, set_.contains(index_));
+        JS_ASSERT_IF(index_ < set_.numBits_, set_.contains(index_));
         return *this;
     }
 
     unsigned int operator *() {
-        JS_ASSERT(index_ < set_.max_);
+        JS_ASSERT(index_ < set_.numBits_);
         return index_;
     }
 };

From c9d9fd8426fb4189f8fe8c8e69a652a9d3c710b0 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 059/144] Bug 949171 - SpiderMonkey: Remove fudge from the
 RawLengthForBits calculation, and fix Safepoint reading to be ok with this.
 r=nbp

---
 js/src/jit/BitSet.h       |  8 +++++---
 js/src/jit/Safepoints.cpp | 15 +++++++--------
 js/src/jit/Safepoints.h   |  2 +-
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index 434b2bac5a77..b602b4285222 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -21,8 +21,10 @@ namespace jit {
 class BitSet : private TempObject
 {
   public:
+    static const size_t BitsPerWord = 8 * sizeof(uint32_t);
+
     static size_t RawLengthForBits(size_t bits) {
-        return 1 + bits / (8 * sizeof(uint32_t));
+        return (bits + BitsPerWord - 1) / BitsPerWord;
     }
 
   private:
@@ -34,11 +36,11 @@ class BitSet : private TempObject
     uint32_t *bits_;
 
     static inline uint32_t bitForValue(unsigned int value) {
-        return 1l << (uint32_t)(value % (8 * sizeof(uint32_t)));
+        return 1l << uint32_t(value % BitsPerWord);
     }
 
     static inline unsigned int wordForValue(unsigned int value) {
-        return value / (8 * sizeof(uint32_t));
+        return value / BitsPerWord;
     }
 
     inline unsigned int numWords() const {
diff --git a/js/src/jit/Safepoints.cpp b/js/src/jit/Safepoints.cpp
index 125d35acb012..c4f0c7906ecf 100644
--- a/js/src/jit/Safepoints.cpp
+++ b/js/src/jit/Safepoints.cpp
@@ -374,22 +374,21 @@ SafepointReader::InvalidationPatchPoint(IonScript *script, const SafepointIndex
 void
 SafepointReader::advanceFromGcRegs()
 {
-    currentSlotChunkNumber_ = 0;
-    currentSlotChunk_ = stream_.readUnsigned();
+    currentSlotChunk_ = 0;
+    nextSlotChunkNumber_ = 0;
 }
 
 bool
 SafepointReader::getSlotFromBitmap(uint32_t *slot)
 {
     while (currentSlotChunk_ == 0) {
-        currentSlotChunkNumber_++;
-
         // Are there any more chunks to read?
-        if (currentSlotChunkNumber_ == BitSet::RawLengthForBits(frameSlots_))
+        if (nextSlotChunkNumber_ == BitSet::RawLengthForBits(frameSlots_))
             return false;
 
         // Yes, read the next chunk.
         currentSlotChunk_ = stream_.readUnsigned();
+        nextSlotChunkNumber_++;
     }
 
     // The current chunk still has bits in it, so get the next bit, then mask
@@ -399,7 +398,7 @@ SafepointReader::getSlotFromBitmap(uint32_t *slot)
 
     // Return the slot, taking care to add 1 back in since it was subtracted
     // when added in the original bitset.
-    *slot = (currentSlotChunkNumber_ * sizeof(uint32_t) * 8) + bit + 1;
+    *slot = ((nextSlotChunkNumber_ - 1) * BitSet::BitsPerWord) + bit + 1;
     return true;
 }
 
@@ -416,8 +415,8 @@ void
 SafepointReader::advanceFromGcSlots()
 {
     // No, reset the counter.
-    currentSlotChunkNumber_ = 0;
-    currentSlotChunk_ = stream_.readUnsigned();
+    currentSlotChunk_ = 0;
+    nextSlotChunkNumber_ = 0;
 }
 
 bool
diff --git a/js/src/jit/Safepoints.h b/js/src/jit/Safepoints.h
index c151634452ac..ea30e50b29be 100644
--- a/js/src/jit/Safepoints.h
+++ b/js/src/jit/Safepoints.h
@@ -61,7 +61,7 @@ class SafepointReader
     CompactBufferReader stream_;
     uint32_t frameSlots_;
     uint32_t currentSlotChunk_;
-    uint32_t currentSlotChunkNumber_;
+    uint32_t nextSlotChunkNumber_;
     uint32_t osiCallPointOffset_;
     GeneralRegisterSet gcSpills_;
     GeneralRegisterSet valueSpills_;

From 329bfe15baf1ab30630e84c70852cc59244e1344 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 060/144] Bug 949171 - IonMonkey: Check more things in
 AssertBasicGraphCoherency. r=nbp

---
 js/src/jit/IonAnalysis.cpp | 63 ++++++++++++++++++++++++++------------
 js/src/jit/MIR.h           |  1 +
 2 files changed, 44 insertions(+), 20 deletions(-)

diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 839c3ecb2305..049c9de5c5c6 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1253,29 +1253,19 @@ CheckPredecessorImpliesSuccessor(MBasicBlock *A, MBasicBlock *B)
 }
 
 static bool
-CheckOperandImpliesUse(MInstruction *ins, MDefinition *operand)
+CheckOperandImpliesUse(MNode *n, MDefinition *operand)
 {
     for (MUseIterator i = operand->usesBegin(); i != operand->usesEnd(); i++) {
-        if (i->consumer()->isDefinition() && i->consumer()->toDefinition() == ins)
+        if (i->consumer() == n)
             return true;
     }
     return false;
 }
 
 static bool
-CheckUseImpliesOperand(MInstruction *ins, MUse *use)
+CheckUseImpliesOperand(MDefinition *def, MUse *use)
 {
-    MNode *consumer = use->consumer();
-    uint32_t index = use->index();
-
-    if (consumer->isDefinition()) {
-        MDefinition *def = consumer->toDefinition();
-        return (def->getOperand(index) == ins);
-    }
-
-    JS_ASSERT(consumer->isResumePoint());
-    MResumePoint *res = consumer->toResumePoint();
-    return (res->getOperand(index) == ins);
+    return use->consumer()->getOperand(use->index()) == def;
 }
 #endif // DEBUG
 
@@ -1283,11 +1273,27 @@ void
 jit::AssertBasicGraphCoherency(MIRGraph &graph)
 {
 #ifdef DEBUG
+    JS_ASSERT(graph.entryBlock()->numPredecessors() == 0);
+    JS_ASSERT(graph.entryBlock()->phisEmpty());
+    JS_ASSERT(!graph.entryBlock()->unreachable());
+
+    if (MBasicBlock *osrBlock = graph.osrBlock()) {
+        JS_ASSERT(osrBlock->numPredecessors() == 0);
+        JS_ASSERT(osrBlock->phisEmpty());
+        JS_ASSERT(osrBlock != graph.entryBlock());
+        JS_ASSERT(!osrBlock->unreachable());
+    }
+
+    if (MResumePoint *resumePoint = graph.entryResumePoint())
+        JS_ASSERT(resumePoint->block() == graph.entryBlock());
+
     // Assert successor and predecessor list coherency.
     uint32_t count = 0;
     for (MBasicBlockIterator block(graph.begin()); block != graph.end(); block++) {
         count++;
 
+        JS_ASSERT(&block->graph() == &graph);
+
         for (size_t i = 0; i < block->numSuccessors(); i++)
             JS_ASSERT(CheckSuccessorImpliesPredecessor(*block, block->getSuccessor(i)));
 
@@ -1295,13 +1301,30 @@ jit::AssertBasicGraphCoherency(MIRGraph &graph)
             JS_ASSERT(CheckPredecessorImpliesSuccessor(*block, block->getPredecessor(i)));
 
         // Assert that use chains are valid for this instruction.
-        for (MInstructionIterator ins = block->begin(); ins != block->end(); ins++) {
-            for (uint32_t i = 0, e = ins->numOperands(); i < e; i++)
-                JS_ASSERT(CheckOperandImpliesUse(*ins, ins->getOperand(i)));
+        for (MDefinitionIterator iter(*block); iter; iter++) {
+            for (uint32_t i = 0, e = iter->numOperands(); i < e; i++)
+                JS_ASSERT(CheckOperandImpliesUse(*iter, iter->getOperand(i)));
         }
-        for (MInstructionIterator ins = block->begin(); ins != block->end(); ins++) {
-            for (MUseIterator i(ins->usesBegin()); i != ins->usesEnd(); i++)
-                JS_ASSERT(CheckUseImpliesOperand(*ins, *i));
+        for (MResumePointIterator iter(block->resumePointsBegin()); iter != block->resumePointsEnd(); iter++) {
+            for (uint32_t i = 0, e = iter->numOperands(); i < e; i++) {
+                if (iter->getUseFor(i)->hasProducer())
+                    JS_ASSERT(CheckOperandImpliesUse(*iter, iter->getOperand(i)));
+            }
+        }
+        for (MPhiIterator phi(block->phisBegin()); phi != block->phisEnd(); phi++) {
+            JS_ASSERT(phi->numOperands() == block->numPredecessors());
+        }
+        for (MDefinitionIterator iter(*block); iter; iter++) {
+            JS_ASSERT(iter->block() == *block);
+            for (MUseIterator i(iter->usesBegin()); i != iter->usesEnd(); i++)
+                JS_ASSERT(CheckUseImpliesOperand(*iter, *i));
+
+            if (iter->isInstruction()) {
+                if (MResumePoint *resume = iter->toInstruction()->resumePoint()) {
+                    if (MInstruction *ins = resume->instruction())
+                        JS_ASSERT(ins->block() == iter->block());
+                }
+            }
         }
     }
 
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 3eff668f0e5a..b8bd03eb23f1 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9005,6 +9005,7 @@ class MResumePoint MOZ_FINAL : public MNode, public InlineForwardListNode<MResum
 
   private:
     friend class MBasicBlock;
+    friend void AssertBasicGraphCoherency(MIRGraph &graph);
 
     FixedList<MUse> operands_;
     uint32_t stackDepth_;

From 7bfe3843b4f032b3ac890deb89eeb985497c5301 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:48 -0800
Subject: [PATCH 061/144] Bug 949171 - IonMonkey: Enforce some invariants for
 LSafepoint. r=nbp

---
 js/src/jit/LIR.h | 63 +++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 49 insertions(+), 14 deletions(-)

diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 20ad0db4317d..3181cd053871 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -1026,6 +1026,14 @@ class LSafepoint : public TempObject
     SlotList slotsOrElementsSlots_;
 
   public:
+    void assertInvariants() {
+        // Every register in valueRegs and gcRegs should also be in liveRegs.
+#ifndef JS_NUNBOX32
+        JS_ASSERT((valueRegs().bits() & ~liveRegs().gprs().bits()) == 0);
+#endif
+        JS_ASSERT((gcRegs().bits() & ~liveRegs().gprs().bits()) == 0);
+    }
+
     LSafepoint(TempAllocator &alloc)
       : safepointOffset_(INVALID_SAFEPOINT_OFFSET)
       , osiCallPointOffset_(0)
@@ -1036,9 +1044,12 @@ class LSafepoint : public TempObject
       , partialNunboxes_(0)
 #endif
       , slotsOrElementsSlots_(alloc)
-    { }
+    {
+      assertInvariants();
+    }
     void addLiveRegister(AnyRegister reg) {
         liveRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     const RegisterSet &liveRegs() const {
         return liveRegs_;
@@ -1046,6 +1057,7 @@ class LSafepoint : public TempObject
 #ifdef CHECK_OSIPOINT_REGISTERS
     void addTempRegister(AnyRegister reg) {
         tempRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     const RegisterSet &tempRegs() const {
         return tempRegs_;
@@ -1053,12 +1065,16 @@ class LSafepoint : public TempObject
 #endif
     void addGcRegister(Register reg) {
         gcRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     GeneralRegisterSet gcRegs() const {
         return gcRegs_;
     }
     bool addGcSlot(uint32_t slot) {
-        return gcSlots_.append(slot);
+        bool result = gcSlots_.append(slot);
+        if (result)
+            assertInvariants();
+        return result;
     }
     SlotList &gcSlots() {
         return gcSlots_;
@@ -1072,18 +1088,23 @@ class LSafepoint : public TempObject
     }
     void addSlotsOrElementsRegister(Register reg) {
         slotsOrElementsRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     bool addSlotsOrElementsSlot(uint32_t slot) {
-        return slotsOrElementsSlots_.append(slot);
+        bool result = slotsOrElementsSlots_.append(slot);
+        if (result)
+            assertInvariants();
+        return result;
     }
     bool addSlotsOrElementsPointer(LAllocation alloc) {
         if (alloc.isStackSlot())
             return addSlotsOrElementsSlot(alloc.toStackSlot()->slot());
         JS_ASSERT(alloc.isRegister());
         addSlotsOrElementsRegister(alloc.toRegister().gpr());
+        assertInvariants();
         return true;
     }
-    bool hasSlotsOrElementsPointer(LAllocation alloc) {
+    bool hasSlotsOrElementsPointer(LAllocation alloc) const {
         if (alloc.isRegister())
             return slotsOrElementsRegs().has(alloc.toRegister().gpr());
         if (alloc.isStackSlot()) {
@@ -1101,10 +1122,11 @@ class LSafepoint : public TempObject
             return addGcSlot(alloc.toStackSlot()->slot());
         if (alloc.isRegister())
             addGcRegister(alloc.toRegister().gpr());
+        assertInvariants();
         return true;
     }
 
-    bool hasGcPointer(LAllocation alloc) {
+    bool hasGcPointer(LAllocation alloc) const {
         if (alloc.isRegister())
             return gcRegs().has(alloc.toRegister().gpr());
         if (alloc.isStackSlot()) {
@@ -1119,13 +1141,16 @@ class LSafepoint : public TempObject
     }
 
     bool addValueSlot(uint32_t slot) {
-        return valueSlots_.append(slot);
+        bool result = valueSlots_.append(slot);
+        if (result)
+            assertInvariants();
+        return result;
     }
     SlotList &valueSlots() {
         return valueSlots_;
     }
 
-    bool hasValueSlot(uint32_t slot) {
+    bool hasValueSlot(uint32_t slot) const {
         for (size_t i = 0; i < valueSlots_.length(); i++) {
             if (valueSlots_[i] == slot)
                 return true;
@@ -1136,7 +1161,10 @@ class LSafepoint : public TempObject
 #ifdef JS_NUNBOX32
 
     bool addNunboxParts(LAllocation type, LAllocation payload) {
-        return nunboxParts_.append(NunboxEntry(type, payload));
+        bool result = nunboxParts_.append(NunboxEntry(type, payload));
+        if (result)
+            assertInvariants();
+        return result;
     }
 
     bool addNunboxType(uint32_t typeVreg, LAllocation type) {
@@ -1153,10 +1181,13 @@ class LSafepoint : public TempObject
 
         // vregs for nunbox pairs are adjacent, with the type coming first.
         uint32_t payloadVreg = typeVreg + 1;
-        return nunboxParts_.append(NunboxEntry(type, LUse(payloadVreg, LUse::ANY)));
+        bool result = nunboxParts_.append(NunboxEntry(type, LUse(payloadVreg, LUse::ANY)));
+        if (result)
+            assertInvariants();
+        return result;
     }
 
-    bool hasNunboxType(LAllocation type) {
+    bool hasNunboxType(LAllocation type) const {
         if (type.isArgument())
             return true;
         if (type.isStackSlot() && hasValueSlot(type.toStackSlot()->slot() + 1))
@@ -1182,10 +1213,13 @@ class LSafepoint : public TempObject
 
         // vregs for nunbox pairs are adjacent, with the type coming first.
         uint32_t typeVreg = payloadVreg - 1;
-        return nunboxParts_.append(NunboxEntry(LUse(typeVreg, LUse::ANY), payload));
+        bool result = nunboxParts_.append(NunboxEntry(LUse(typeVreg, LUse::ANY), payload));
+        if (result)
+            assertInvariants();
+        return result;
     }
 
-    bool hasNunboxPayload(LAllocation payload) {
+    bool hasNunboxPayload(LAllocation payload) const {
         if (payload.isArgument())
             return true;
         if (payload.isStackSlot() && hasValueSlot(payload.toStackSlot()->slot()))
@@ -1209,8 +1243,9 @@ class LSafepoint : public TempObject
 
     void addValueRegister(Register reg) {
         valueRegs_.add(reg);
+        assertInvariants();
     }
-    GeneralRegisterSet valueRegs() {
+    GeneralRegisterSet valueRegs() const {
         return valueRegs_;
     }
 
@@ -1233,7 +1268,7 @@ class LSafepoint : public TempObject
         return true;
     }
 
-    bool hasBoxedValue(LAllocation alloc) {
+    bool hasBoxedValue(LAllocation alloc) const {
         if (alloc.isRegister())
             return valueRegs().has(alloc.toRegister().gpr());
         if (alloc.isStackSlot())

From 4047601939ef0dd079b0efce318b8d36feef348b Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 08:54:04 -0800
Subject: [PATCH 062/144] Bug 944407 - Allow scripts for an XBL binding if and
 only if the XBL document comes from a scriptable domain. r=bz

---
 content/xbl/src/nsXBLBinding.cpp          | 23 +----------------------
 content/xbl/src/nsXBLBinding.h            |  2 +-
 content/xbl/src/nsXBLDocumentInfo.cpp     | 18 ++++++++++++++++++
 content/xbl/src/nsXBLDocumentInfo.h       |  2 +-
 content/xbl/src/nsXBLPrototypeBinding.cpp |  2 +-
 content/xbl/src/nsXBLPrototypeBinding.h   |  2 +-
 6 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
index f8dbfc46df4c..a91fe995ce68 100644
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1082,28 +1082,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JS::Handle<JSObject*> global,
 bool
 nsXBLBinding::AllowScripts()
 {
-  if (!mPrototypeBinding->GetAllowScripts())
-    return false;
-
-  // Nasty hack.  Use the JSContext of the bound node, since the
-  // security manager API expects to get the docshell type from
-  // that.  But use the nsIPrincipal of our document.
-  nsIScriptSecurityManager* mgr = nsContentUtils::GetSecurityManager();
-  if (!mgr) {
-    return false;
-  }
-
-  nsIDocument* doc = mBoundElement ? mBoundElement->OwnerDoc() : nullptr;
-  if (!doc) {
-    return false;
-  }
-
-  nsCOMPtr<nsIScriptGlobalObject> global = do_QueryInterface(doc->GetInnerWindow());
-  if (!global || !global->GetGlobalJSObject()) {
-    return false;
-  }
-
-  return mgr->ScriptAllowed(global->GetGlobalJSObject());
+  return mPrototypeBinding->GetAllowScripts();
 }
 
 nsXBLBinding*
diff --git a/content/xbl/src/nsXBLBinding.h b/content/xbl/src/nsXBLBinding.h
index ac577fe3b1bd..c2af9a993db8 100644
--- a/content/xbl/src/nsXBLBinding.h
+++ b/content/xbl/src/nsXBLBinding.h
@@ -141,7 +141,7 @@ public:
                                 JS::MutableHandle<JSObject*> aClassObject,
                                 bool* aNew);
 
-  bool AllowScripts();  // XXX make const
+  bool AllowScripts();
 
   mozilla::dom::XBLChildrenElement* FindInsertionPointFor(nsIContent* aChild);
 
diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
index 5c304c26566e..b3f6acde8d4c 100644
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -403,6 +403,24 @@ nsXBLDocumentInfo::nsXBLDocumentInfo(nsIDocument* aDocument)
       mScriptAccess = allow;
     }
     mIsChrome = true;
+  } else {
+    // If this binding isn't running with system principal, then it's running
+    // from a remote-XUL whitelisted domain. This is already a not-really-
+    // supported configuration (among other things, we don't use XBL scopes in
+    // that configuration for compatibility reasons). But we should still at
+    // least make an effort to prevent binding code from running if content
+    // script is disabled or if the source domain is blacklisted (since the
+    // source domain for remote XBL must always be the same as the source domain
+    // of the bound content).
+    //
+    // If we just ask the binding document if script is enabled, it will
+    // discover that it has no inner window, and return false. So instead, we
+    // short-circuit the normal compartment-managed script-disabling machinery,
+    // and query the policy for the URI directly.
+    bool allow;
+    nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
+    nsresult rv = ssm->PolicyAllowsScript(uri, &allow);
+    mScriptAccess = NS_SUCCEEDED(rv) && allow;
   }
 }
 
diff --git a/content/xbl/src/nsXBLDocumentInfo.h b/content/xbl/src/nsXBLDocumentInfo.h
index 9c88d504e90a..412738a4118d 100644
--- a/content/xbl/src/nsXBLDocumentInfo.h
+++ b/content/xbl/src/nsXBLDocumentInfo.h
@@ -27,7 +27,7 @@ public:
   already_AddRefed<nsIDocument> GetDocument()
     { nsCOMPtr<nsIDocument> copy = mDocument; return copy.forget(); }
 
-  bool GetScriptAccess() { return mScriptAccess; }
+  bool GetScriptAccess() const { return mScriptAccess; }
 
   nsIURI* DocumentURI() { return mDocument->GetDocumentURI(); }
 
diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
index eb0e351ab593..385c3dd3ba4b 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.cpp
+++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
@@ -214,7 +214,7 @@ nsXBLPrototypeBinding::SetBindingElement(nsIContent* aElement)
 }
 
 bool
-nsXBLPrototypeBinding::GetAllowScripts()
+nsXBLPrototypeBinding::GetAllowScripts() const
 {
   return mXBLDocInfoWeak->GetScriptAccess();
 }
diff --git a/content/xbl/src/nsXBLPrototypeBinding.h b/content/xbl/src/nsXBLPrototypeBinding.h
index e38fc8e9e355..eb3fe54df2d8 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.h
+++ b/content/xbl/src/nsXBLPrototypeBinding.h
@@ -48,7 +48,7 @@ public:
   // binding URIs.
   bool CompareBindingURI(nsIURI* aURI) const;
 
-  bool GetAllowScripts();
+  bool GetAllowScripts() const;
 
   nsresult BindingAttached(nsIContent* aBoundElement);
   nsresult BindingDetached(nsIContent* aBoundElement);

From 9d29199dc3aff1c1cfd8a892b77cf7a6f138330a Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 08:54:04 -0800
Subject: [PATCH 063/144] Bug 944407 - Tests. r=bz

---
 content/xbl/test/chrome.ini          |  3 ++
 content/xbl/test/file_bug944407.html |  8 +++
 content/xbl/test/file_bug944407.xml  | 78 ++++++++++++++++++++++++++++
 content/xbl/test/mochitest.ini       |  2 +
 content/xbl/test/test_bug944407.xul  | 44 ++++++++++++++++
 5 files changed, 135 insertions(+)
 create mode 100644 content/xbl/test/file_bug944407.html
 create mode 100644 content/xbl/test/file_bug944407.xml
 create mode 100644 content/xbl/test/test_bug944407.xul

diff --git a/content/xbl/test/chrome.ini b/content/xbl/test/chrome.ini
index f55d0ff8c4e4..cf117273acfb 100644
--- a/content/xbl/test/chrome.ini
+++ b/content/xbl/test/chrome.ini
@@ -1,4 +1,6 @@
 [DEFAULT]
+support-files =
+  file_bug944407.xml
 
 [test_bug378518.xul]
 [test_bug398135.xul]
@@ -6,3 +8,4 @@
 [test_bug721452.xul]
 [test_bug723676.xul]
 [test_bug772966.xul]
+[test_bug944407.xul]
diff --git a/content/xbl/test/file_bug944407.html b/content/xbl/test/file_bug944407.html
new file mode 100644
index 000000000000..5df5d5bc97b0
--- /dev/null
+++ b/content/xbl/test/file_bug944407.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div id="deny" style="-moz-binding: url(file_bug944407.xml#testAllowScript)"></div>
+<div id="allow" style="-moz-binding: url(chrome://mochitests/content/chrome/content/xbl/test/file_bug944407.xml#testAllowScript)"</div>
+<script>/* Flush layout with a script tab - see bug 944407 comment 37. */</script>
+</body>
+</html>
diff --git a/content/xbl/test/file_bug944407.xml b/content/xbl/test/file_bug944407.xml
new file mode 100644
index 000000000000..6aa980dfce9c
--- /dev/null
+++ b/content/xbl/test/file_bug944407.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0"?>
+<bindings id="testBindings" xmlns="http://www.mozilla.org/xbl"
+          xmlns:html="http://www.w3.org/1999/xhtml">
+  <binding id="testAllowScript">
+    <implementation>
+       <property name="someProp" onget="return 2;" readonly="true"></property>
+       <method name="someMethod"><body> return 3; </body></method>
+       <method name="startTest">
+         <body>
+         <![CDATA[
+           // Make sure we only get constructed when we're loaded from a domain
+           // with script enabled.
+           is(this.id, 'allow', "XBL should only be bound when the origin of the binding allows scripts");
+
+           var t = this;
+           doFinish = function() {
+             // Take a moment to make sure that other constructors don't run when they shouldn't.
+             if (t.id == 'allow')
+               setTimeout(SpecialPowers.wrap(window.parent).finish, 100);
+           }
+
+           onTestEvent = function(target) {
+             ok(true, 'called event handler');
+
+             // First, dispatch an event to the anonymous content. The event
+             // handlers on the AC should run, but they won't until bug 948000
+             // is fixed. So the check here is a todo().
+             var e = new MouseEvent('click');
+             document.getAnonymousNodes(target)[1].dispatchEvent(e);
+
+             // Now, dispatch a key event to test key handlers and move the test along.
+             var k = document.createEvent('KeyboardEvent');
+             k.initEvent('keyup', true, true);
+             target.dispatchEvent(k);
+           }
+
+           // Check the implementation.
+           is(this.someProp, 2, "Properties work");
+           is(this.someMethod(), 3, "Methods work");
+
+           // Kick over to the event handlers. This tests XBL event handlers,
+           // XBL key handlers, and event handlers on anonymous content.
+           this.dispatchEvent(new CustomEvent('testEvent'));
+         ]]>
+         </body>
+       </method>
+
+      <constructor>
+      <![CDATA[
+        win = XPCNativeWrapper.unwrap(window);
+        SpecialPowers = win.SpecialPowers;
+        ok = win.ok = SpecialPowers.wrap(window.parent).ok;
+        todo = win.todo = SpecialPowers.wrap(window.parent).todo;
+        is = win.is = SpecialPowers.wrap(window.parent).is;
+        info = win.info = SpecialPowers.wrap(window.parent).info;
+
+        info("Invoked constructor for " + this.id);
+
+        var t = this;
+        window.addEventListener('load', function loadListener() {
+          window.removeEventListener('load', loadListener);
+          // Wait two refresh-driver ticks to make sure that the constructor runs
+          // for both |allow| and |deny| if it's ever going to.
+          //
+          // See bug 944407 comment 37.
+          info("Invoked load listener for " + t.id);
+          window.requestAnimationFrame(function() { window.requestAnimationFrame(t.startTest.bind(t)); });
+        });
+      ]]>
+      </constructor>
+    </implementation>
+    <handlers>
+      <handler event="testEvent" action="onTestEvent(this)" allowuntrusted="true"/>
+      <handler event="keyup" action="ok(true, 'called key handler'); doFinish();" allowuntrusted="true"/>
+    </handlers>
+    <content>Anonymous Content<html:div onclick="todo(true, 'called event handler on ac, this needs bug 948000');"></html:div><html:b style="display:none"><children/></html:b></content>
+  </binding>
+</bindings>
diff --git a/content/xbl/test/mochitest.ini b/content/xbl/test/mochitest.ini
index 8c82329009d9..b390426f19a5 100644
--- a/content/xbl/test/mochitest.ini
+++ b/content/xbl/test/mochitest.ini
@@ -12,6 +12,8 @@ support-files =
   file_bug591198_xbl.xml
   file_bug821850.xhtml
   file_bug844783.xhtml
+  file_bug944407.html
+  file_bug944407.xml
 
 [test_bug310107.html]
 [test_bug366770.html]
diff --git a/content/xbl/test/test_bug944407.xul b/content/xbl/test/test_bug944407.xul
new file mode 100644
index 000000000000..c4ddd200f7e0
--- /dev/null
+++ b/content/xbl/test/test_bug944407.xul
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=944407
+-->
+<window title="Mozilla Bug 944407"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=944407"
+     target="_blank">Mozilla Bug 944407</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for XBL bindings with script disabled. **/
+  SimpleTest.waitForExplicitFinish();
+  const Cu = Components.utils;
+  Cu.import('resource://gre/modules/Services.jsm');
+
+  function go() {
+
+    // Disable javascript, and load the frame.
+    function loadFrame() {
+      ok(!Services.prefs.getBoolPref('javascript.enabled'), "Javascript should be disabled");
+      $('ifr').setAttribute('src', 'http://mochi.test:8888/tests/content/xbl/test/file_bug944407.html');
+    }
+    SpecialPowers.pushPrefEnv({ set: [['javascript.enabled', false]] }, loadFrame);
+  }
+
+  function finish() {
+    SimpleTest.finish();
+  }
+
+  addLoadEvent(go);
+  ]]>
+  </script>
+  <iframe id='ifr' />
+</window>

From b31e1049fab111c1aa128c998f34b10880f1c633 Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Fri, 13 Dec 2013 17:58:00 +0100
Subject: [PATCH 064/144] Bug 949474 - Reflect the fact that the nominal range
 for the sampleRate argument of the AudioContext.createBuffer changed in the
 spec. r= * * * Bug 949474 - Fix various oranges, on a CLOSED TREE.

--HG--
extra : rebase_source : 1317857063b7f028687aab1c00f113d947cd5685
---
 content/media/webaudio/AudioContext.cpp          |  4 ++--
 .../media/webaudio/test/test_AudioBuffer.html    | 16 +++++++++++-----
 .../test_audioBufferSourceNodeLoopStartEnd.html  |  2 --
 content/media/webaudio/test/test_bug808374.html  |  9 ++++++---
 4 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index f269163652f7..850727f1ef6c 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -174,8 +174,8 @@ AudioContext::CreateBuffer(JSContext* aJSContext, uint32_t aNumberOfChannels,
                            uint32_t aLength, float aSampleRate,
                            ErrorResult& aRv)
 {
-  if (aSampleRate < 8000 || aSampleRate > 96000 || !aLength) {
-    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  if (aSampleRate < 8000 || aSampleRate > 192000 || !aLength || !aNumberOfChannels) {
+    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }
 
diff --git a/content/media/webaudio/test/test_AudioBuffer.html b/content/media/webaudio/test/test_AudioBuffer.html
index 75eeb7ff00e5..47716853bf6c 100644
--- a/content/media/webaudio/test/test_AudioBuffer.html
+++ b/content/media/webaudio/test/test_AudioBuffer.html
@@ -81,15 +81,21 @@ addLoadEvent(function() {
 
   expectException(function() {
     context.createBuffer(2, 2048, 7999);
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INDEX_SIZE_ERR);
   expectException(function() {
-    context.createBuffer(2, 2048, 96001);
-  }, DOMException.NOT_SUPPORTED_ERR);
+    context.createBuffer(2, 2048, 192001);
+  }, DOMException.INDEX_SIZE_ERR);
   context.createBuffer(2, 2048, 8000);  // no exception
-  context.createBuffer(2, 2048, 96000); // no exception
+  context.createBuffer(2, 2048, 192000); // no exception
+  context.createBuffer(32, 2048, 48000); // no exception
+  // Null length
   expectException(function() {
     context.createBuffer(2, 0, 48000);
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INDEX_SIZE_ERR);
+  // Null number of channels
+  expectException(function() {
+    context.createBuffer(0, 2048, 48000);
+  }, DOMException.INDEX_SIZE_ERR);
   SimpleTest.finish();
 });
 
diff --git a/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html b/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html
index 59c2bfd166f5..6f60762eb834 100644
--- a/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html
+++ b/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html
@@ -21,8 +21,6 @@ var gTest = {
 
     var source = context.createBufferSource();
     source.buffer = buffer;
-
-    var sp = context.createScriptProcessor(2048 * 4, 1);
     source.start(0);
     source.loop = true;
     source.loopStart = buffer.duration * 0.25;
diff --git a/content/media/webaudio/test/test_bug808374.html b/content/media/webaudio/test/test_bug808374.html
index 3e4ffd428476..cc4e02f41860 100644
--- a/content/media/webaudio/test/test_bug808374.html
+++ b/content/media/webaudio/test/test_bug808374.html
@@ -9,9 +9,12 @@
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
-var ctx = new AudioContext();
-ctx.createBuffer(0, 1, ctx.sampleRate);
-ok(true, "The test should not crash during CC");
+try {
+  var ctx = new AudioContext();
+  ctx.createBuffer(0, 1, ctx.sampleRate);
+} catch (e) {
+  ok(true, "The test should not crash during CC");
+}
 
 </script>
 </pre>

From ab8787514ace5dd2a8c8eb6438f90a4f66344ea7 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 16:26:37 -0800
Subject: [PATCH 065/144] Bug 949108 - Rooting hazards in nsScriptLoader.cpp
 due to AutoPushJSContext, r=bz

--HG--
extra : rebase_source : 02c19e3831118d3d4703c7904ea0b7228c06261f
---
 content/base/src/nsScriptLoader.cpp | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index e3f8c945e825..b8bbfc85f4d4 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -789,8 +789,11 @@ nsScriptLoader::AttemptAsyncScriptParse(nsScriptLoadRequest* aRequest)
   if (!context) {
     return NS_ERROR_FAILURE;
   }
-  AutoPushJSContext cx(context->GetNativeContext());
-  JS::Rooted<JSObject*> global(cx, unrootedGlobal);
+
+  JSContext* unpushedCx = context->GetNativeContext();
+  JSAutoRequest ar(unpushedCx);
+  JS::Rooted<JSObject*> global(unpushedCx, unrootedGlobal);
+  AutoPushJSContext cx(unpushedCx);
 
   JS::CompileOptions options(cx);
   FillCompileOptionsForRequest(aRequest, global, &options);
@@ -1002,8 +1005,11 @@ nsScriptLoader::EvaluateScript(nsScriptLoadRequest* aRequest,
   if (!context) {
     return NS_ERROR_FAILURE;
   }
-  AutoPushJSContext cx(context->GetNativeContext());
-  JS::Rooted<JSObject*> global(cx, unrootedGlobal);
+
+  JSContext* unpushedCx = context->GetNativeContext();
+  JSAutoRequest ar(unpushedCx);
+  JS::Rooted<JSObject*> global(unpushedCx, unrootedGlobal);
+  AutoPushJSContext cx(unpushedCx);
 
   bool oldProcessingScriptTag = context->GetProcessingScriptTag();
   context->SetProcessingScriptTag(true);

From 9c371ba0531ec6af3294bb830d7331daecf3500c Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Thu, 12 Dec 2013 18:35:39 +0100
Subject: [PATCH 066/144] Bug 947431 - Be more robust when getting the
 preferred sample rate when using the OpenSL backend. r=kinetik

--HG--
extra : rebase_source : a55d98b9ce2cc6a9c2559d9589984faf8063c301
---
 media/libcubeb/src/cubeb_opensl.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/media/libcubeb/src/cubeb_opensl.c b/media/libcubeb/src/cubeb_opensl.c
index e0fb6fc9b979..c2d5c8e86d16 100644
--- a/media/libcubeb/src/cubeb_opensl.c
+++ b/media/libcubeb/src/cubeb_opensl.c
@@ -275,6 +275,14 @@ opensl_get_preferred_sample_rate(cubeb * ctx, uint32_t * rate)
 
   dlclose(libmedia);
 
+  /* Depending on which method we called above, we can get a zero back, yet have
+   * a non-error return value, especially if the audio system is not
+   * ready/shutting down (i.e. when we can't get our hand on the AudioFlinger
+   * thread). */
+  if (rate == 0) {
+    return CUBEB_ERROR;
+  }
+
   return CUBEB_OK;
 }
 

From 6068ab757be66131e4034c202fd1ef5b5e776151 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 17:56:20 +0100
Subject: [PATCH 067/144] Bug 927782 - Part 1: Expose
 JSScript::getBlockScope(jsbytecode *). r=luke

---
 js/src/jsopcode.cpp       | 53 +--------------------------------------
 js/src/jsopcode.h         |  5 ----
 js/src/jsscript.cpp       | 52 ++++++++++++++++++++++++++++++++++++++
 js/src/jsscript.h         |  3 +++
 js/src/vm/ScopeObject.cpp |  2 +-
 5 files changed, 57 insertions(+), 58 deletions(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 504fc6a14868..ceb86e3b9af1 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -1429,57 +1429,6 @@ js_QuoteString(ExclusiveContext *cx, JSString *str, jschar quote)
 
 /************************************************************************/
 
-StaticBlockObject *
-js::GetBlockChainAtPC(JSScript *script, jsbytecode *pc)
-{
-    JS_ASSERT(script->containsPC(pc));
-
-    if (!script->hasBlockScopes())
-        return nullptr;
-
-    if (pc < script->main())
-        return nullptr;
-    ptrdiff_t offset = pc - script->main();
-
-    BlockScopeArray *blockScopes = script->blockScopes();
-    StaticBlockObject *blockChain = nullptr;
-
-    // Find the innermost block chain using a binary search.
-    size_t bottom = 0;
-    size_t top = blockScopes->length;
-
-    while (bottom < top) {
-        size_t mid = bottom + (top - bottom) / 2;
-        const BlockScopeNote *note = &blockScopes->vector[mid];
-        if (note->start <= offset) {
-            // Block scopes are ordered in the list by their starting offset, and since
-            // blocks form a tree ones earlier in the list may cover the pc even if
-            // later blocks end before the pc. This only happens when the earlier block
-            // is a parent of the later block, so we need to check parents of |mid| in
-            // the searched range for coverage.
-            size_t check = mid;
-            while (check >= bottom) {
-                const BlockScopeNote *checkNote = &blockScopes->vector[check];
-                JS_ASSERT(checkNote->start <= offset);
-                if (offset < checkNote->start + checkNote->length) {
-                    // We found a matching block chain but there may be inner ones
-                    // at a higher block chain index than mid. Continue the binary search.
-                    blockChain = &script->getObject(checkNote->index)->as<StaticBlockObject>();
-                    break;
-                }
-                if (checkNote->parent == UINT32_MAX)
-                    break;
-                check = checkNote->parent;
-            }
-            bottom = mid + 1;
-        } else {
-            top = mid;
-        }
-    }
-
-    return blockChain;
-}
-
 namespace {
 /*
  * The expression decompiler is invoked by error handling code to produce a
@@ -1740,7 +1689,7 @@ JSAtom *
 ExpressionDecompiler::findLetVar(jsbytecode *pc, unsigned depth)
 {
     if (script->hasObjects()) {
-        JSObject *chain = GetBlockChainAtPC(script, pc);
+        JSObject *chain = script->getBlockScope(pc);
         if (!chain)
             return nullptr;
         JS_ASSERT(chain->is<BlockObject>());
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 3f019c99aeb0..ed75130495f7 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -777,11 +777,6 @@ GetNextPc(jsbytecode *pc)
     return pc + GetBytecodeLength(pc);
 }
 
-class StaticBlockObject;
-
-StaticBlockObject *
-GetBlockChainAtPC(JSScript *script, jsbytecode *pc);
-
 } /* namespace js */
 
 #if defined(DEBUG)
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index e1004f988947..b94db57d618e 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -2894,6 +2894,58 @@ LazyScript::finalize(FreeOp *fop)
         fop->free_(table_);
 }
 
+StaticBlockObject *
+JSScript::getBlockScope(jsbytecode *pc)
+{
+    JS_ASSERT(containsPC(pc));
+
+    if (!hasBlockScopes())
+        return nullptr;
+
+    ptrdiff_t offset = pc - main();
+
+    if (offset < 0)
+        return nullptr;
+
+    BlockScopeArray *scopes = blockScopes();
+    StaticBlockObject *blockChain = nullptr;
+
+    // Find the innermost block chain using a binary search.
+    size_t bottom = 0;
+    size_t top = scopes->length;
+
+    while (bottom < top) {
+        size_t mid = bottom + (top - bottom) / 2;
+        const BlockScopeNote *note = &scopes->vector[mid];
+        if (note->start <= offset) {
+            // Block scopes are ordered in the list by their starting offset, and since
+            // blocks form a tree ones earlier in the list may cover the pc even if
+            // later blocks end before the pc. This only happens when the earlier block
+            // is a parent of the later block, so we need to check parents of |mid| in
+            // the searched range for coverage.
+            size_t check = mid;
+            while (check >= bottom) {
+                const BlockScopeNote *checkNote = &scopes->vector[check];
+                JS_ASSERT(checkNote->start <= offset);
+                if (offset < checkNote->start + checkNote->length) {
+                    // We found a matching block chain but there may be inner ones
+                    // at a higher block chain index than mid. Continue the binary search.
+                    blockChain = &getObject(checkNote->index)->as<StaticBlockObject>();
+                    break;
+                }
+                if (checkNote->parent == UINT32_MAX)
+                    break;
+                check = checkNote->parent;
+            }
+            bottom = mid + 1;
+        } else {
+            top = mid;
+        }
+    }
+
+    return blockChain;
+}
+
 void
 JSScript::setArgumentsHasVarBinding()
 {
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 544f3798767f..09d88c489bdc 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -43,6 +43,7 @@ class RegExpObject;
 struct SourceCompressionTask;
 class Shape;
 class WatchpointMap;
+class StaticBlockObject;
 
 namespace analyze {
     class ScriptAnalysis;
@@ -1268,6 +1269,8 @@ class JSScript : public js::gc::BarrieredCell<JSScript>
         return arr->vector[index];
     }
 
+    js::StaticBlockObject *getBlockScope(jsbytecode *pc);
+
     /*
      * The isEmpty method tells whether this script has code that computes any
      * result (not return value, result AKA normal completion value) other than
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 4997f4022e25..8114c0b89a65 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -38,7 +38,7 @@ InnermostStaticScope(JSScript *script, jsbytecode *pc)
     JS_ASSERT(script->containsPC(pc));
     JS_ASSERT(JOF_OPTYPE(*pc) == JOF_SCOPECOORD);
 
-    StaticBlockObject *block = GetBlockChainAtPC(script, pc);
+    StaticBlockObject *block = script->getBlockScope(pc);
     if (block)
         return block;
     return script->function();

From 759b9344ea1869fa69b335fc161a126f3767905e Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Mon, 25 Nov 2013 12:19:38 +0100
Subject: [PATCH 068/144] Bug 927782 - Part 2: Remove HAS_BLOCKCHAIN. r=luke

---
 js/src/jit/BaselineCompiler.cpp | 2 ++
 js/src/jit/BaselineFrame.cpp    | 5 +----
 js/src/jit/BaselineFrame.h      | 9 ++-------
 js/src/vm/Stack-inl.h           | 2 +-
 js/src/vm/Stack.cpp             | 3 +--
 js/src/vm/Stack.h               | 7 +++----
 6 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index febad931dae9..d0b4b16f323c 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -289,6 +289,8 @@ BaselineCompiler::emitPrologue()
     else
         masm.storePtr(R1.scratchReg(), frame.addressOfScopeChain());
 
+    masm.storePtr(ImmPtr(nullptr), frame.addressOfBlockChain());
+
     // Functions with a large number of locals require two stack checks.
     // The VMCall for a fallible stack check can only occur after the
     // scope chain has been initialized, as that is required for proper
diff --git a/js/src/jit/BaselineFrame.cpp b/js/src/jit/BaselineFrame.cpp
index ed89bd40b193..82ca90ca60ca 100644
--- a/js/src/jit/BaselineFrame.cpp
+++ b/js/src/jit/BaselineFrame.cpp
@@ -113,10 +113,7 @@ BaselineFrame::initForOsr(StackFrame *fp, uint32_t numStackValues)
     if (fp->hasCallObjUnchecked())
         flags_ |= BaselineFrame::HAS_CALL_OBJ;
 
-    if (fp->hasBlockChain()) {
-        flags_ |= BaselineFrame::HAS_BLOCKCHAIN;
-        blockChain_ = &fp->blockChain();
-    }
+    blockChain_ = fp->maybeBlockChain();
 
     if (fp->isEvalFrame()) {
         flags_ |= BaselineFrame::EVAL;
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index e996a2cfbb22..32d92b1fcaf3 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -38,9 +38,6 @@ class BaselineFrame
         // The frame has a valid return value. See also StackFrame::HAS_RVAL.
         HAS_RVAL         = 1 << 0,
 
-        // Frame has blockChain_ set.
-        HAS_BLOCKCHAIN   = 1 << 1,
-
         // A call object has been pushed on the scope chain.
         HAS_CALL_OBJ     = 1 << 2,
 
@@ -72,7 +69,7 @@ class BaselineFrame
     uint32_t hiReturnValue_;
     uint32_t frameSize_;
     JSObject *scopeChain_;          // Scope chain (always initialized).
-    StaticBlockObject *blockChain_; // If HAS_BLOCKCHAIN, the static block chain.
+    StaticBlockObject *blockChain_; // The static block chain.
     JSScript *evalScript_;          // If isEvalFrame(), the current eval script.
     ArgumentsObject *argsObj_;      // If HAS_ARGS_OBJ, the arguments object.
     void *hookData_;                // If HAS_HOOK_DATA, debugger call hook data.
@@ -213,7 +210,7 @@ class BaselineFrame
     }
 
     bool hasBlockChain() const {
-        return (flags_ & HAS_BLOCKCHAIN) && blockChain_;
+        return blockChain_;
     }
     StaticBlockObject &blockChain() const {
         JS_ASSERT(hasBlockChain());
@@ -223,11 +220,9 @@ class BaselineFrame
         return hasBlockChain() ? blockChain_ : nullptr;
     }
     void setBlockChain(StaticBlockObject &block) {
-        flags_ |= HAS_BLOCKCHAIN;
         blockChain_ = &block;
     }
     void setBlockChainNull() {
-        JS_ASSERT(!hasBlockChain());
         blockChain_ = nullptr;
     }
     StaticBlockObject **addressOfBlockChain() {
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 914841fcb952..daa06c529d42 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -77,7 +77,7 @@ StackFrame::initCallFrame(JSContext *cx, StackFrame *prev, jsbytecode *prevpc, V
     JS_ASSERT(callee.nonLazyScript() == script);
 
     /* Initialize stack frame members. */
-    flags_ = FUNCTION | HAS_SCOPECHAIN | HAS_BLOCKCHAIN | flagsArg;
+    flags_ = FUNCTION | HAS_SCOPECHAIN | flagsArg;
     argv_ = argv;
     exec.fun = &callee;
     u.nactual = nactual;
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 6f386270908a..c31af6d82d9a 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -37,7 +37,7 @@ StackFrame::initExecuteFrame(JSContext *cx, JSScript *script, AbstractFramePtr e
      * script in the context of another frame and the frame type is determined
      * by the context.
      */
-    flags_ = type | HAS_SCOPECHAIN | HAS_BLOCKCHAIN;
+    flags_ = type | HAS_SCOPECHAIN;
 
     JSObject *callee = nullptr;
     if (!(flags_ & (GLOBAL))) {
@@ -366,7 +366,6 @@ StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
         blockChain_ = &block;
     }
 
-    flags_ |= HAS_BLOCKCHAIN;
     return true;
 }
 
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 775736fee778..053a02f61120 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -311,7 +311,6 @@ class StackFrame
         HAS_HOOK_DATA      =      0x400,  /* frame has hookData_ set */
         HAS_RVAL           =      0x800,  /* frame has rval_ set */
         HAS_SCOPECHAIN     =     0x1000,  /* frame has scopeChain_ set */
-        HAS_BLOCKCHAIN     =     0x2000,  /* frame has blockChain_ set */
 
         /* Debugger state */
         PREV_UP_TO_DATE    =     0x4000,  /* see DebugScopes::updateLiveScopes */
@@ -341,7 +340,7 @@ class StackFrame
     } u;
     mutable JSObject    *scopeChain_;   /* if HAS_SCOPECHAIN, current scope chain */
     Value               rval_;          /* if HAS_RVAL, return value of the frame */
-    StaticBlockObject   *blockChain_;   /* if HAS_BLOCKCHAIN, innermost let block */
+    StaticBlockObject   *blockChain_;   /* innermost let block */
     ArgumentsObject     *argsObj_;      /* if HAS_ARGS_OBJ, the call's arguments object */
 
     /*
@@ -605,11 +604,11 @@ class StackFrame
      */
 
     bool hasBlockChain() const {
-        return (flags_ & HAS_BLOCKCHAIN) && blockChain_;
+        return blockChain_;
     }
 
     StaticBlockObject *maybeBlockChain() {
-        return (flags_ & HAS_BLOCKCHAIN) ? blockChain_ : nullptr;
+        return blockChain_;
     }
 
     StaticBlockObject &blockChain() const {

From 622f257d7851d0971adb4a1be43e3d1c3c69de7b Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Mon, 25 Nov 2013 12:19:58 +0100
Subject: [PATCH 069/144] Bug 927782 - Part 3: Add DEBUGLEAVEBLOCK opcode to
 invalidate live DebugScopes. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 19 ++++++++++++++++++-
 js/src/jit/BaselineCompiler.cpp     | 15 +++++++++++++++
 js/src/jit/BaselineCompiler.h       |  1 +
 js/src/jit/BaselineFrame-inl.h      |  3 ---
 js/src/jit/VMFunctions.cpp          | 11 +++++++++++
 js/src/jit/VMFunctions.h            |  1 +
 js/src/jsopcode.tbl                 |  3 +--
 js/src/vm/Interpreter.cpp           | 15 ++++++++++++++-
 js/src/vm/Stack.cpp                 |  5 -----
 9 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index db41a0a88c7a..c073363c1c3c 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -588,6 +588,8 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
                 stmt = stmt->down;
                 if (stmt == toStmt)
                     break;
+                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                    return false;
                 if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
                     return false;
                 if (stmt->type == STMT_FOR_OF_LOOP) {
@@ -600,6 +602,8 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
                 EMIT_UINT16_IMM_OP(JSOP_POPN, popCount);
             } else {
                 /* There is a Block object with locals on the stack to pop. */
+                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                    return false;
                 EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
             }
         }
@@ -2622,8 +2626,11 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    if (pn->pn_right->isKind(PNK_LEXICALSCOPE))
+    if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
         EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
+    }
 
     return true;
 }
@@ -3941,6 +3948,8 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                  */
                 if (Emit1(cx, bce, JSOP_THROWING) < 0)
                     return false;
+                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                    return false;
                 EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, count);
                 JS_ASSERT(bce->stackDepth == depth);
             }
@@ -4200,6 +4209,8 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     if (!EmitTree(cx, bce, letBody->pn_expr))
         return false;
 
+    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        return false;
     JSOp leaveOp = letBody->getOp();
     JS_ASSERT(leaveOp == JSOP_LEAVEBLOCK || leaveOp == JSOP_LEAVEBLOCKEXPR);
     EMIT_UINT16_IMM_OP(leaveOp, blockObj->slotCount());
@@ -4233,6 +4244,8 @@ EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!EmitTree(cx, bce, pn->pn_expr))
         return false;
 
+    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        return false;
     EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, slots);
 
     return PopStatementBCE(cx, bce);
@@ -4410,6 +4423,8 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PopStatementBCE(cx, bce))
             return false;
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
         if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
             return false;
     }
@@ -4569,6 +4584,8 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PopStatementBCE(cx, bce))
             return false;
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
         if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
             return false;
     }
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index d0b4b16f323c..b9309fcc67a9 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -2625,6 +2625,21 @@ BaselineCompiler::emit_JSOP_ENTERLET2()
     return emitEnterBlock();
 }
 
+typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *);
+static const VMFunction DebugLeaveBlockInfo = FunctionInfo<DebugLeaveBlockFn>(jit::DebugLeaveBlock);
+
+bool
+BaselineCompiler::emit_JSOP_DEBUGLEAVEBLOCK()
+{
+    // Call a stub to pop the block from the block chain.
+    prepareVMCall();
+
+    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(R0.scratchReg());
+
+    return callVM(DebugLeaveBlockInfo);
+}
+
 typedef bool (*LeaveBlockFn)(JSContext *, BaselineFrame *);
 static const VMFunction LeaveBlockInfo = FunctionInfo<LeaveBlockFn>(jit::LeaveBlock);
 
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index 1b4d5a8a2c96..a72ceb5e358e 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -152,6 +152,7 @@ namespace jit {
     _(JSOP_LEAVEBLOCK)         \
     _(JSOP_LEAVEBLOCKEXPR)     \
     _(JSOP_LEAVEFORLETIN)      \
+    _(JSOP_DEBUGLEAVEBLOCK)    \
     _(JSOP_EXCEPTION)          \
     _(JSOP_DEBUGGER)           \
     _(JSOP_ARGUMENTS)          \
diff --git a/js/src/jit/BaselineFrame-inl.h b/js/src/jit/BaselineFrame-inl.h
index 8d107515a4a3..234dae4d1969 100644
--- a/js/src/jit/BaselineFrame-inl.h
+++ b/js/src/jit/BaselineFrame-inl.h
@@ -55,9 +55,6 @@ BaselineFrame::popBlock(JSContext *cx)
 {
     JS_ASSERT(hasBlockChain());
 
-    if (cx->compartment()->debugMode())
-        DebugScopes::onPopBlock(cx, this);
-
     if (blockChain_->needsClone()) {
         JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
         popOffScopeChain();
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 8c8ad1c9c753..04fd28a4a003 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -894,6 +894,17 @@ LeaveBlock(JSContext *cx, BaselineFrame *frame)
     return true;
 }
 
+bool
+DebugLeaveBlock(JSContext *cx, BaselineFrame *frame)
+{
+    JS_ASSERT(frame->hasBlockChain());
+
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
+        DebugScopes::onPopBlock(cx, frame);
+
+    return true;
+}
+
 bool
 InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame, uint32_t numStackValues)
 {
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 7fcd44d49c52..a29ae2b6fbf4 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -654,6 +654,7 @@ bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bo
 
 bool EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
 bool LeaveBlock(JSContext *cx, BaselineFrame *frame);
+bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame);
 
 bool InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame,
                              uint32_t numStackValues);
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index 8a6a1ee215ce..0e419e58a800 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -438,9 +438,8 @@ OPDEF(JSOP_TYPEOFEXPR,    197,"typeofexpr",  NULL,    1,  1,  1, JOF_BYTE|JOF_DE
  */
 OPDEF(JSOP_ENTERBLOCK,    198,"enterblock",  NULL,    5,  0, -1,  JOF_OBJECT)
 OPDEF(JSOP_LEAVEBLOCK,    199,"leaveblock",  NULL,    3, -1,  0,  JOF_UINT16)
+OPDEF(JSOP_DEBUGLEAVEBLOCK, 200,"debugleaveblock", NULL, 1,  0,  0,  JOF_BYTE)
 
-
-OPDEF(JSOP_UNUSED200,     200,"unused200",  NULL,     1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED201,     201,"unused201",  NULL,     1,  0,  0,  JOF_BYTE)
 
 /*
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index fe105d373d44..e076291e5b2a 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -855,6 +855,8 @@ js::UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth)
           case ScopeIter::Block:
             if (si.staticBlock().stackDepth() < stackDepth)
                 return;
+            if (cx->compartment()->debugMode())
+                DebugScopes::onPopBlock(cx, frame);
             frame.popBlock(cx);
             break;
           case ScopeIter::With:
@@ -1533,7 +1535,6 @@ CASE(JSOP_UNUSED191)
 CASE(JSOP_UNUSED192)
 CASE(JSOP_UNUSED194)
 CASE(JSOP_UNUSED196)
-CASE(JSOP_UNUSED200)
 CASE(JSOP_UNUSED201)
 CASE(JSOP_GETFUNNS)
 CASE(JSOP_UNUSED208)
@@ -3268,6 +3269,18 @@ CASE(JSOP_LEAVEBLOCKEXPR)
 }
 END_CASE(JSOP_LEAVEBLOCK)
 
+CASE(JSOP_DEBUGLEAVEBLOCK)
+{
+    JS_ASSERT(REGS.fp()->hasBlockChain());
+
+    // FIXME: This opcode should not be necessary.  The debugger shouldn't need
+    // help from bytecode to do its job.  See bug 927782.
+
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
+        DebugScopes::onPopBlock(cx, REGS.fp());
+}
+END_CASE(JSOP_DEBUGLEAVEBLOCK)
+
 CASE(JSOP_GENERATOR)
 {
     JS_ASSERT(!cx->isExceptionPending());
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index c31af6d82d9a..0f8e40ab1b30 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -372,11 +372,6 @@ StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
 void
 StackFrame::popBlock(JSContext *cx)
 {
-    JS_ASSERT(hasBlockChain());
-
-    if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onPopBlock(cx, this);
-
     if (blockChain_->needsClone()) {
         JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
         popOffScopeChain();

From 616863d9825bd8c44fa442ff7b6013a0018d9c4a Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:22:06 +0100
Subject: [PATCH 070/144] Bug 927782 - Part 4: Generators allocate all locals
 on the scope chain. r=luke

---
 dom/indexedDB/test/unit/test_cursor_cycle.js  |  5 -
 .../test/unit/test_cursor_mutation.js         |  5 -
 .../test/unit/test_index_object_cursors.js    |  3 -
 .../test/unit/test_index_update_delete.js     |  3 -
 js/src/frontend/BytecodeEmitter.cpp           | 29 +++++-
 js/src/frontend/Parser.cpp                    |  2 +-
 js/src/frontend/SharedContext.h               | 17 +++-
 js/src/jsfun.h                                |  3 +-
 js/src/vm/ScopeObject.cpp                     | 99 +++----------------
 js/src/vm/ScopeObject.h                       | 14 +--
 js/src/vm/Stack-inl.h                         |  8 --
 js/src/vm/Stack.cpp                           | 24 -----
 js/src/vm/Stack.h                             |  4 -
 13 files changed, 58 insertions(+), 158 deletions(-)

diff --git a/dom/indexedDB/test/unit/test_cursor_cycle.js b/dom/indexedDB/test/unit/test_cursor_cycle.js
index 440f1b0a8423..795a9b63d708 100644
--- a/dom/indexedDB/test/unit/test_cursor_cycle.js
+++ b/dom/indexedDB/test/unit/test_cursor_cycle.js
@@ -22,11 +22,6 @@ function testSteps()
   objectStore.add(Bob);
   yield undefined;
 
-  // This direct eval causes locals to be aliased, and thus allocated on
-  // the scope chain.  Comment it out (and the workarounds below) and
-  // the test passes.  Bug 943409.
-  eval('');
-
   db.transaction("foo", "readwrite").objectStore("foo")
     .index("name").openCursor().onsuccess = function(event) {
     event.target.transaction.oncomplete = continueToNextStep;
diff --git a/dom/indexedDB/test/unit/test_cursor_mutation.js b/dom/indexedDB/test/unit/test_cursor_mutation.js
index 059c68e3b4aa..13e859891c1d 100644
--- a/dom/indexedDB/test/unit/test_cursor_mutation.js
+++ b/dom/indexedDB/test/unit/test_cursor_mutation.js
@@ -35,11 +35,6 @@ function testSteps()
   let objectStore = db.createObjectStore("foo", { keyPath: "ss" });
   objectStore.createIndex("name", "name", { unique: true });
 
-  // This direct eval causes locals to be aliased, and thus allocated on
-  // the scope chain.  Comment it out (and the workarounds below) and
-  // the test passes.  Bug 943409.
-  eval('');
-
   for (let i = 0; i < objectStoreData.length - 1; i++) {
     objectStore.add(objectStoreData[i]);
   }
diff --git a/dom/indexedDB/test/unit/test_index_object_cursors.js b/dom/indexedDB/test/unit/test_index_object_cursors.js
index d15c3efd4748..f3daa433b656 100644
--- a/dom/indexedDB/test/unit/test_index_object_cursors.js
+++ b/dom/indexedDB/test/unit/test_index_object_cursors.js
@@ -34,9 +34,6 @@ function testSteps()
 
   event.target.onsuccess = continueToNextStep;
 
-  // Bug 943409.
-  eval('');
-
   for (let objectStoreIndex in objectStoreData) {
     const objectStoreInfo = objectStoreData[objectStoreIndex];
     let objectStore = db.createObjectStore(objectStoreInfo.name,
diff --git a/dom/indexedDB/test/unit/test_index_update_delete.js b/dom/indexedDB/test/unit/test_index_update_delete.js
index 03cd8c10bef2..77c666079a76 100644
--- a/dom/indexedDB/test/unit/test_index_update_delete.js
+++ b/dom/indexedDB/test/unit/test_index_update_delete.js
@@ -18,9 +18,6 @@ function testSteps()
   let db = event.target.result;
   db.onerror = errorHandler;
 
-  // Bug 943409.
-  eval('');
-
   for each (let autoIncrement in [false, true]) {
     let objectStore =
       db.createObjectStore(autoIncrement, { keyPath: "id",
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index c073363c1c3c..9277bfd761bb 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1024,9 +1024,14 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
         /*
          * There are two ways to alias a let variable: nested functions and
          * dynamic scope operations. (This is overly conservative since the
-         * bindingsAccessedDynamically flag is function-wide.)
+         * bindingsAccessedDynamically flag, checked by allLocalsAliased, is
+         * function-wide.)
+         *
+         * In addition all locals in generators are marked as aliased, to ensure
+         * that they are allocated on scope chains instead of on the stack.  See
+         * the definition of SharedContext::allLocalsAliased.
          */
-        return dn->isClosed() || sc->bindingsAccessedDynamically();
+        return dn->isClosed() || sc->allLocalsAliased();
       case Definition::ARG:
         /*
          * Consult the bindings, since they already record aliasing. We might
@@ -1035,12 +1040,13 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
          * a given name is aliased. This is necessary to avoid generating a
          * shape for the call object with with more than one name for a given
          * slot (which violates internal engine invariants). All this means that
-         * the '|| sc->bindingsAccessedDynamically' disjunct is incorrect since
-         * it will mark both parameters in function(x,x) as aliased.
+         * the '|| sc->allLocalsAliased()' disjunct is incorrect since it will
+         * mark both parameters in function(x,x) as aliased.
          */
         return script->formalIsAliased(pn->pn_cookie.slot());
       case Definition::VAR:
       case Definition::CONST:
+        JS_ASSERT_IF(sc->allLocalsAliased(), script->varIsAliased(pn->pn_cookie.slot()));
         return script->varIsAliased(pn->pn_cookie.slot());
       case Definition::PLACEHOLDER:
       case Definition::NAMED_LAMBDA:
@@ -1072,6 +1078,17 @@ AdjustBlockSlot(ExclusiveContext *cx, BytecodeEmitter *bce, int slot)
     return slot;
 }
 
+#ifdef DEBUG
+static bool
+AllLocalsAliased(StaticBlockObject &obj)
+{
+    for (unsigned i = 0; i < obj.slotCount(); i++)
+        if (!obj.isAliased(i))
+            return false;
+    return true;
+}
+#endif
+
 static bool
 EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp op)
 {
@@ -1108,7 +1125,7 @@ EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp o
 
         /* Beware the empty destructuring dummy. */
         if (!dn) {
-            blockObj->setAliased(i, bce->sc->bindingsAccessedDynamically());
+            blockObj->setAliased(i, bce->sc->allLocalsAliased());
             continue;
         }
 
@@ -1129,6 +1146,8 @@ EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp o
         blockObj->setAliased(i, bce->isAliasedName(dn));
     }
 
+    JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(*blockObj));
+
     return true;
 }
 
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 1bcbd752e9dd..3702596a7c0e 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -278,7 +278,7 @@ AppendPackedBindings(const ParseContext<ParseHandler> *pc, const DeclVector &vec
          */
         JS_ASSERT_IF(dn->isClosed(), pc->decls().lookupFirst(name) == dn);
         bool aliased = dn->isClosed() ||
-                       (pc->sc->bindingsAccessedDynamically() &&
+                       (pc->sc->allLocalsAliased() &&
                         pc->decls().lookupFirst(name) == dn);
 
         *dst = Binding(name, kind, aliased);
diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
index fa3d97001764..36591f55e06f 100644
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -200,6 +200,8 @@ class SharedContext
     void setBindingsAccessedDynamically() { anyCxFlags.bindingsAccessedDynamically = true; }
     void setHasDebuggerStatement()        { anyCxFlags.hasDebuggerStatement        = true; }
 
+    inline bool allLocalsAliased();
+
     // JSOPTION_EXTRA_WARNINGS warnings or strict mode errors.
     bool needStrictChecks() {
         return strict || extraWarnings;
@@ -307,7 +309,8 @@ class FunctionBox : public ObjectBox, public SharedContext
         // Note: this should be kept in sync with JSFunction::isHeavyweight().
         return bindings.hasAnyAliasedBindings() ||
                hasExtensibleScope() ||
-               needsDeclEnvObject();
+               needsDeclEnvObject() ||
+               isGenerator();
     }
 };
 
@@ -318,6 +321,18 @@ SharedContext::asFunctionBox()
     return static_cast<FunctionBox*>(this);
 }
 
+// In generators, we treat all locals as aliased so that they get stored on the
+// heap.  This way there is less information to copy off the stack when
+// suspending, and back on when resuming.  It also avoids the need to create and
+// invalidate DebugScope proxies for unaliased locals in a generator frame, as
+// the generator frame will be copied out to the heap and released only by GC.
+inline bool
+SharedContext::allLocalsAliased()
+{
+    return bindingsAccessedDynamically() || (isFunctionBox() && asFunctionBox()->isGenerator());
+}
+
+
 /*
  * NB: If you add a new type of statement that is a scope, add it between
  * STMT_WITH and STMT_CATCH, or you will break StmtInfoBase::linksScope. If you
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 21e19a0fd805..df45c30e4f04 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -100,7 +100,8 @@ class JSFunction : public JSObject
         // Note: this should be kept in sync with FunctionBox::isHeavyweight().
         return nonLazyScript()->bindings.hasAnyAliasedBindings() ||
                nonLazyScript()->funHasExtensibleScope() ||
-               nonLazyScript()->funNeedsDeclEnvObject();
+               nonLazyScript()->funNeedsDeclEnvObject() ||
+               isGenerator();
     }
 
     /* A function can be classified as either native (C++) or interpreted (JS): */
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 8114c0b89a65..95e31570278c 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -885,18 +885,6 @@ ScopeIter::ScopeIter(AbstractFramePtr frame, JSContext *cx
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 }
 
-ScopeIter::ScopeIter(const ScopeIter &si, AbstractFramePtr frame, JSContext *cx
-                     MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
-  : cx(si.cx),
-    frame_(frame),
-    cur_(cx, si.cur_),
-    block_(cx, si.block_),
-    type_(si.type_),
-    hasScopeObject_(si.hasScopeObject_)
-{
-    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-}
-
 ScopeIter::ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : cx(cx),
@@ -1095,8 +1083,7 @@ class DebugScopeProxy : public BaseProxyHandler
      * the normal Call/BlockObject scope objects and thus must be recovered
      * from somewhere else:
      *  + if the invocation for which the scope was created is still executing,
-     *    there is a StackFrame (either live on the stack or floating in a
-     *    generator object) holding the values;
+     *    there is a StackFrame live on the stack holding the values;
      *  + if the invocation for which the scope was created finished executing:
      *     - and there was a DebugScopeObject associated with scope, then the
      *       DebugScopes::onPop(Call|Block) handler copied out the unaliased
@@ -1595,9 +1582,8 @@ void
 DebugScopes::sweep(JSRuntime *rt)
 {
     /*
-     * Note: missingScopes points to debug scopes weakly not just so that debug
-     * scopes can be released more eagerly, but, more importantly, to avoid
-     * creating an uncollectable cycle with suspended generator frames.
+     * missingScopes points to debug scopes weakly so that debug scopes can be
+     * released more eagerly.
      */
     for (MissingScopeMap::Enum e(missingScopes); !e.empty(); e.popFront()) {
         DebugScopeObject **debugScope = e.front().value().unsafeGet();
@@ -1626,7 +1612,6 @@ DebugScopes::sweep(JSRuntime *rt)
 
     for (LiveScopeMap::Enum e(liveScopes); !e.empty(); e.popFront()) {
         ScopeObject *scope = e.front().key();
-        AbstractFramePtr frame = e.front().value();
 
         /*
          * Scopes can be finalized when a debugger-synthesized ScopeObject is
@@ -1636,19 +1621,6 @@ DebugScopes::sweep(JSRuntime *rt)
             e.removeFront();
             continue;
         }
-
-        /*
-         * As explained in onGeneratorFrameChange, liveScopes includes
-         * suspended generator frames. Since a generator can be finalized while
-         * its scope is live, we must explicitly detect finalized generators.
-         */
-        if (JSGenerator *gen = frame.maybeSuspendedGenerator(rt)) {
-            JS_ASSERT(gen->state == JSGEN_NEWBORN || gen->state == JSGEN_OPEN);
-            if (IsObjectAboutToBeFinalized(&gen->obj)) {
-                e.removeFront();
-                continue;
-            }
-        }
     }
 }
 
@@ -1739,6 +1711,7 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
 {
     JS_ASSERT(!si.hasScopeObject());
     JS_ASSERT(cx->compartment() == debugScope.compartment());
+    JS_ASSERT_IF(si.frame().isFunctionFrame(), !si.frame().callee()->isGenerator());
 
     if (!CanUseDebugScopeMaps(cx))
         return true;
@@ -1890,43 +1863,6 @@ DebugScopes::onPopStrictEvalScope(AbstractFramePtr frame)
         scopes->liveScopes.remove(&frame.scopeChain()->as<CallObject>());
 }
 
-void
-DebugScopes::onGeneratorFrameChange(AbstractFramePtr from, AbstractFramePtr to, JSContext *cx)
-{
-    for (ScopeIter toIter(to, cx); !toIter.done(); ++toIter) {
-        DebugScopes *scopes = ensureCompartmentData(cx);
-        if (!scopes)
-            return;
-
-        if (toIter.hasScopeObject()) {
-            /*
-             * Not only must we correctly replace mappings [scope -> from] with
-             * mappings [scope -> to], but we must add [scope -> to] if it
-             * doesn't already exist so that if we need to proxy a generator's
-             * scope while it is suspended, we can find its frame (which would
-             * otherwise not be found by AllFramesIter).
-             */
-            JS_ASSERT(toIter.scope().compartment() == cx->compartment());
-            LiveScopeMap::AddPtr livePtr = scopes->liveScopes.lookupForAdd(&toIter.scope());
-            if (livePtr) {
-                livePtr->value() = to;
-            } else {
-                scopes->liveScopes.add(livePtr, &toIter.scope(), to);  // OOM here?
-                liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &toIter.scope());
-            }
-        } else {
-            ScopeIter si(toIter, from, cx);
-            JS_ASSERT(si.frame().scopeChain()->compartment() == cx->compartment());
-            if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
-                DebugScopeObject &debugScope = *p->value();
-                scopes->liveScopes.lookup(&debugScope.scope())->value() = to;
-                scopes->missingScopes.remove(p);
-                scopes->missingScopes.put(toIter, &debugScope);  // OOM here?
-            }
-        }
-    }
-}
-
 void
 DebugScopes::onCompartmentLeaveDebugMode(JSCompartment *c)
 {
@@ -1966,6 +1902,9 @@ DebugScopes::updateLiveScopes(JSContext *cx)
         if (frame.scopeChain()->compartment() != cx->compartment())
             continue;
 
+        if (frame.isFunctionFrame() && frame.callee()->isGenerator())
+            continue;
+
         for (ScopeIter si(frame, cx); !si.done(); ++si) {
             if (si.hasScopeObject()) {
                 JS_ASSERT(si.scope().compartment() == cx->compartment());
@@ -1994,25 +1933,9 @@ DebugScopes::hasLiveFrame(ScopeObject &scope)
     if (!scopes)
         return NullFramePtr();
 
-    if (LiveScopeMap::Ptr p = scopes->liveScopes.lookup(&scope)) {
-        AbstractFramePtr frame = p->value();
+    if (LiveScopeMap::Ptr p = scopes->liveScopes.lookup(&scope))
+        return p->value();
 
-        /*
-         * Since liveScopes is effectively a weak pointer, we need a read
-         * barrier. The scenario where this is necessary is:
-         *  1. GC starts, a suspended generator is not live
-         *  2. hasLiveFrame returns a StackFrame* to the (soon to be dead)
-         *     suspended generator
-         *  3. stack frame values (which will neve be marked) are read from the
-         *     StackFrame
-         *  4. GC completes, live objects may now point to values that weren't
-         *     marked and thus may point to swept GC things
-         */
-        if (JSGenerator *gen = frame.maybeSuspendedGenerator(scope.compartment()->runtimeFromMainThread()))
-            JSObject::readBarrier(gen->obj);
-
-        return frame;
-    }
     return NullFramePtr();
 }
 
@@ -2074,6 +1997,8 @@ GetDebugScopeForMissing(JSContext *cx, const ScopeIter &si)
     DebugScopeObject *debugScope = nullptr;
     switch (si.type()) {
       case ScopeIter::Call: {
+        // Generators should always reify their scopes.
+        JS_ASSERT(!si.frame().callee()->isGenerator());
         Rooted<CallObject*> callobj(cx, CallObject::createForFunction(cx, si.frame()));
         if (!callobj)
             return nullptr;
@@ -2090,6 +2015,8 @@ GetDebugScopeForMissing(JSContext *cx, const ScopeIter &si)
         break;
       }
       case ScopeIter::Block: {
+        // Generators should always reify their scopes.
+        JS_ASSERT_IF(si.frame().isFunctionFrame(), !si.frame().callee()->isGenerator());
         Rooted<StaticBlockObject *> staticBlock(cx, &si.staticBlock());
         ClonedBlockObject *block = ClonedBlockObject::create(cx, staticBlock, si.frame());
         if (!block)
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index 07207d4eaf7b..f5eb96a4edf2 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -548,13 +548,6 @@ class ScopeIter
     explicit ScopeIter(JSObject &enclosingScope, JSContext *cx
                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
-    /*
-     * For the special case of generators, copy the given ScopeIter, with 'fp'
-     * as the StackFrame instead of si.fp(). Not for general use.
-     */
-    ScopeIter(const ScopeIter &si, AbstractFramePtr frame, JSContext *cx
-              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
-
     /* Like ScopeIter(StackFrame *) except start at 'scope'. */
     ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
               MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
@@ -719,15 +712,12 @@ class DebugScopes
     static bool updateLiveScopes(JSContext *cx);
     static AbstractFramePtr hasLiveFrame(ScopeObject &scope);
 
-    /*
-     * In debug-mode, these must be called whenever exiting a call/block or
-     * when activating/yielding a generator.
-     */
+    // In debug-mode, these must be called whenever exiting a scope that might
+    // have stack-allocated locals.
     static void onPopCall(AbstractFramePtr frame, JSContext *cx);
     static void onPopBlock(JSContext *cx, AbstractFramePtr frame);
     static void onPopWith(AbstractFramePtr frame);
     static void onPopStrictEvalScope(AbstractFramePtr frame);
-    static void onGeneratorFrameChange(AbstractFramePtr from, AbstractFramePtr to, JSContext *cx);
     static void onCompartmentLeaveDebugMode(JSCompartment *c);
 };
 
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index daa06c529d42..4e47e88d9f45 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -516,14 +516,6 @@ AbstractFramePtr::unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing)
 #endif
 }
 
-inline JSGenerator *
-AbstractFramePtr::maybeSuspendedGenerator(JSRuntime *rt) const
-{
-    if (isStackFrame())
-        return asStackFrame()->maybeSuspendedGenerator(rt);
-    return nullptr;
-}
-
 inline StaticBlockObject *
 AbstractFramePtr::maybeBlockChain() const
 {
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 0f8e40ab1b30..dcb8ea9ae6a9 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -123,9 +123,6 @@ StackFrame::copyFrameAndValues(JSContext *cx, Value *vp, StackFrame *otherfp,
         if (doPostBarrier)
             HeapValue::writeBarrierPost(*dst, dst);
     }
-
-    if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onGeneratorFrameChange(otherfp, this, cx);
 }
 
 /* Note: explicit instantiation for js_NewGenerator located in jsiter.cpp. */
@@ -155,27 +152,6 @@ StackFrame::writeBarrierPost()
         HeapValue::writeBarrierPost(rval_, &rval_);
 }
 
-JSGenerator *
-StackFrame::maybeSuspendedGenerator(JSRuntime *rt)
-{
-    /*
-     * A suspended generator's frame is embedded inside the JSGenerator object
-     * and is not currently running.
-     */
-    if (!isGeneratorFrame() || !isSuspended())
-        return nullptr;
-
-    /*
-     * Once we know we have a suspended generator frame, there is a static
-     * offset from the frame's snapshot to beginning of the JSGenerator.
-     */
-    char *vp = reinterpret_cast<char *>(generatorArgsSnapshotBegin());
-    char *p = vp - offsetof(JSGenerator, stackSnapshot);
-    JSGenerator *gen = reinterpret_cast<JSGenerator *>(p);
-    JS_ASSERT(gen->fp == this);
-    return gen;
-}
-
 bool
 StackFrame::copyRawFrameSlots(AutoValueVector *vec)
 {
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 053a02f61120..4321c1d1f1b9 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -172,8 +172,6 @@ class AbstractFramePtr
 
     operator bool() const { return !!ptr_; }
 
-    inline JSGenerator *maybeSuspendedGenerator(JSRuntime *rt) const;
-
     inline JSObject *scopeChain() const;
     inline CallObject &callObj() const;
     inline bool initFunctionScopeObjects(JSContext *cx);
@@ -863,8 +861,6 @@ class StackFrame
     void copyFrameAndValues(JSContext *cx, Value *vp, StackFrame *otherfp,
                             const Value *othervp, Value *othersp);
 
-    JSGenerator *maybeSuspendedGenerator(JSRuntime *rt);
-
     /*
      * js::Execute pushes both global and function frames (since eval() in a
      * function pushes a frame with isFunctionFrame() && isEvalFrame()). Most

From e877084c47265375a10db2afe3e6fd679b6842da Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 10:11:06 +0100
Subject: [PATCH 071/144] Bug 927782 - Part 5: Clean up bytecode generation for
 catch clauses. r=jorendorff

---
 js/src/frontend/BytecodeEmitter.cpp | 265 +++++++++++++---------------
 js/src/frontend/BytecodeEmitter.h   |   1 +
 2 files changed, 128 insertions(+), 138 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 9277bfd761bb..569cc37067b5 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -3791,8 +3791,6 @@ class EmitLevelManager
 static bool
 EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
-    ptrdiff_t guardJump;
-
     /*
      * Morph STMT_BLOCK to STMT_CATCH, note the block entry code offset,
      * and save the block object atom.
@@ -3841,18 +3839,51 @@ EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         JS_ASSERT(0);
     }
 
-    /* Emit the guard expression, if there is one. */
+    // If there is a guard expression, emit it and arrange to jump to the next
+    // catch block if the guard expression is false.
     if (pn->pn_kid2) {
         if (!EmitTree(cx, bce, pn->pn_kid2))
             return false;
 
-        /* ifeq <next block> */
-        guardJump = EmitJump(cx, bce, JSOP_IFEQ, 0);
+        // If the guard expression is false, fall through, pop the block scope,
+        // and jump to the next catch block.  Otherwise jump over that code and
+        // pop the dupped exception.
+        ptrdiff_t guardCheck = EmitJump(cx, bce, JSOP_IFNE, 0);
+        if (guardCheck < 0)
+            return false;
+
+#ifdef DEBUG
+        uint32_t blockScopeIndex = bce->topStmt->blockScopeIndex;
+        uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
+        ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
+        StaticBlockObject *blockObj = &blockObjBox->object->as<StaticBlockObject>();
+        JS_ASSERT(blockObj == bce->blockChain);
+#endif
+
+        // Save stack depth before popping the block scope.
+        int savedDepth = bce->stackDepth;
+
+        // Move exception back to cx->exception to prepare for
+        // the next catch.
+        if (Emit1(cx, bce, JSOP_THROWING) < 0)
+            return false;
+
+        // Leave the scope for this catch block
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
+        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, bce->blockChain->slotCount());
+
+        // Jump to the next handler.  The jump target is backpatched by EmitTry.
+        ptrdiff_t guardJump = EmitJump(cx, bce, JSOP_GOTO, 0);
         if (guardJump < 0)
             return false;
         stmt->guardJump() = guardJump;
 
-        /* Pop duplicated exception object as we no longer need it. */
+        // Back to normal control flow. restore stack depth after nonlocal exit.
+        bce->stackDepth = savedDepth;
+        SetJumpOffsetAt(bce, guardCheck);
+
+        // Pop duplicated exception object as we no longer need it.
         if (Emit1(cx, bce, JSOP_POP) < 0)
             return false;
     }
@@ -3861,38 +3892,35 @@ EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     return EmitTree(cx, bce, pn->pn_kid3);
 }
 
-/*
- * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See
- * the comment on EmitSwitch.
- */
+// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See the
+// comment on EmitSwitch.
+//
 MOZ_NEVER_INLINE static bool
 EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     StmtInfoBCE stmtInfo(cx);
 
-    /*
-     * Push stmtInfo to track jumps-over-catches and gosubs-to-finally
-     * for later fixup.
-     *
-     * When a finally block is active (STMT_FINALLY in our parse context),
-     * non-local jumps (including jumps-over-catches) result in a GOSUB
-     * being written into the bytecode stream and fixed-up later (c.f.
-     * EmitBackPatchOp and BackPatch).
-     */
+    // Push stmtInfo to track jumps-over-catches and gosubs-to-finally
+    // for later fixup.
+    //
+    // When a finally block is active (STMT_FINALLY in our parse context),
+    // non-local jumps (including jumps-over-catches) result in a GOSUB
+    // being written into the bytecode stream and fixed-up later (c.f.
+    // EmitBackPatchOp and BackPatch).
+    //
     PushStatementBCE(bce, &stmtInfo, pn->pn_kid3 ? STMT_FINALLY : STMT_TRY, bce->offset());
 
-    /*
-     * Since an exception can be thrown at any place inside the try block,
-     * we need to restore the stack and the scope chain before we transfer
-     * the control to the exception handler.
-     *
-     * For that we store in a try note associated with the catch or
-     * finally block the stack depth upon the try entry. The interpreter
-     * uses this depth to properly unwind the stack and the scope chain.
-     */
+    // Since an exception can be thrown at any place inside the try block,
+    // we need to restore the stack and the scope chain before we transfer
+    // the control to the exception handler.
+    //
+    // For that we store in a try note associated with the catch or
+    // finally block the stack depth upon the try entry. The interpreter
+    // uses this depth to properly unwind the stack and the scope chain.
+    //
     int depth = bce->stackDepth;
 
-    /* Mark try location for decompilation, then emit try block. */
+    // Record the try location, then emit the try block.
     ptrdiff_t noteIndex = NewSrcNote(cx, bce, SRC_TRY);
     if (noteIndex < 0 || Emit1(cx, bce, JSOP_TRY) < 0)
         return false;
@@ -3901,146 +3929,101 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         return false;
     JS_ASSERT(depth == bce->stackDepth);
 
-    /* GOSUB to finally, if present. */
+    // GOSUB to finally, if present.
     if (pn->pn_kid3) {
         if (EmitBackPatchOp(cx, bce, &stmtInfo.gosubs()) < 0)
             return false;
     }
 
-    /* Source note points to the jump at the end of the try block. */
+    // Source note points to the jump at the end of the try block.
     if (!SetSrcNoteOffset(cx, bce, noteIndex, 0, bce->offset() - tryStart + JSOP_TRY_LENGTH))
         return false;
 
-    /* Emit (hidden) jump over catch and/or finally. */
+    // Emit jump over catch and/or finally.
     ptrdiff_t catchJump = -1;
     if (EmitBackPatchOp(cx, bce, &catchJump) < 0)
         return false;
 
     ptrdiff_t tryEnd = bce->offset();
 
-    /* If this try has a catch block, emit it. */
-    ParseNode *lastCatch = nullptr;
+    // If this try has a catch block, emit it.
     if (ParseNode *pn2 = pn->pn_kid2) {
-        unsigned count = 0;    /* previous catch block's population */
-
-        /*
-         * The emitted code for a catch block looks like:
-         *
-         * [throwing]                          only if 2nd+ catch block
-         * [leaveblock]                        only if 2nd+ catch block
-         * enterblock
-         * exception
-         * [dup]                               only if catchguard
-         * setlocalpop <slot>                  or destructuring code
-         * [< catchguard code >]               if there's a catchguard
-         * [ifeq <offset to next catch block>]         " "
-         * [pop]                               only if catchguard
-         * < catch block contents >
-         * leaveblock
-         * goto <end of catch blocks>          non-local; finally applies
-         *
-         * If there's no catch block without a catchguard, the last
-         * <offset to next catch block> points to rethrow code.  This
-         * code will [gosub] to the finally code if appropriate, and is
-         * also used for the catch-all trynote for capturing exceptions
-         * thrown from catch{} blocks.
-         */
+        // The emitted code for a catch block looks like:
+        //
+        // enterblock
+        // exception
+        // if there is a catchguard:
+        //   dup
+        // setlocal 0; pop              assign or possibly destructure exception
+        // if there is a catchguard:
+        //   < catchguard code >
+        //   ifne POST
+        //   throwing                   pop exception to cx->exception
+        //   debugleaveblock
+        //   leaveblock
+        //   goto <next catch block>
+        //   POST: pop
+        // < catch block contents >
+        // debugleaveblock
+        // leaveblock
+        // goto <end of catch blocks>   non-local; finally applies
+        //
+        // If there's no catch block without a catchguard, the last <next catch
+        // block> points to rethrow code.  This code will [gosub] to the finally
+        // code if appropriate, and is also used for the catch-all trynote for
+        // capturing exceptions thrown from catch{} blocks.
+        //
         for (ParseNode *pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-            ptrdiff_t guardJump;
-
             JS_ASSERT(bce->stackDepth == depth);
-            guardJump = stmtInfo.guardJump();
-            if (guardJump != -1) {
-                /* Fix up and clean up previous catch block. */
-                SetJumpOffsetAt(bce, guardJump);
 
-                /*
-                 * Account for JSOP_ENTERBLOCK (whose block object count
-                 * is saved below) and pushed exception object that we
-                 * still have after the jumping from the previous guard.
-                 */
-                bce->stackDepth = depth + count + 1;
-
-                /*
-                 * Move exception back to cx->exception to prepare for
-                 * the next catch.
-                 */
-                if (Emit1(cx, bce, JSOP_THROWING) < 0)
-                    return false;
-                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-                    return false;
-                EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, count);
-                JS_ASSERT(bce->stackDepth == depth);
-            }
-
-            /*
-             * Emit the lexical scope and catch body.  Save the catch's
-             * block object population via count, for use when targeting
-             * guardJump at the next catch (the guard mismatch case).
-             */
+            // Emit the lexical scope and catch body.
             JS_ASSERT(pn3->isKind(PNK_LEXICALSCOPE));
-            count = pn3->pn_objbox->object->as<StaticBlockObject>().slotCount();
             if (!EmitTree(cx, bce, pn3))
                 return false;
 
-            /* gosub <finally>, if required */
+            // gosub <finally>, if required.
             if (pn->pn_kid3) {
                 if (EmitBackPatchOp(cx, bce, &stmtInfo.gosubs()) < 0)
                     return false;
                 JS_ASSERT(bce->stackDepth == depth);
             }
 
-            /*
-             * Jump over the remaining catch blocks.  This will get fixed
-             * up to jump to after catch/finally.
-             */
+            // Jump over the remaining catch blocks.  This will get fixed
+            // up to jump to after catch/finally.
             if (EmitBackPatchOp(cx, bce, &catchJump) < 0)
                 return false;
 
-            /*
-             * Save a pointer to the last catch node to handle try-finally
-             * and try-catch(guard)-finally special cases.
-             */
-            lastCatch = pn3->expr();
+            // If this catch block had a guard clause, patch the guard jump to
+            // come here.
+            if (stmtInfo.guardJump() != -1) {
+                SetJumpOffsetAt(bce, stmtInfo.guardJump());
+                stmtInfo.guardJump() = -1;
+
+                // If this catch block is the last one, rethrow, delegating
+                // execution of any finally block to the exception handler.
+                if (!pn3->pn_next) {
+                    if (Emit1(cx, bce, JSOP_EXCEPTION) < 0)
+                        return false;
+                    if (Emit1(cx, bce, JSOP_THROW) < 0)
+                        return false;
+                }
+            }
         }
     }
 
-    /*
-     * Last catch guard jumps to the rethrow code sequence if none of the
-     * guards match. Target guardJump at the beginning of the rethrow
-     * sequence, just in case a guard expression throws and leaves the
-     * stack unbalanced.
-     */
-    if (lastCatch && lastCatch->pn_kid2) {
-        SetJumpOffsetAt(bce, stmtInfo.guardJump());
-
-        /* Sync the stack to take into account pushed exception. */
-        JS_ASSERT(bce->stackDepth == depth);
-        bce->stackDepth = depth + 1;
-
-        /*
-         * Rethrow the exception, delegating executing of finally if any
-         * to the exception handler.
-         */
-        if (Emit1(cx, bce, JSOP_THROW) < 0)
-            return false;
-    }
-
     JS_ASSERT(bce->stackDepth == depth);
 
-    /* Emit finally handler if any. */
-    ptrdiff_t finallyStart = 0;   /* to quell GCC uninitialized warnings */
+    // Emit the finally handler, if there is one.
+    ptrdiff_t finallyStart = 0;
     if (pn->pn_kid3) {
-        /*
-         * Fix up the gosubs that might have been emitted before non-local
-         * jumps to the finally code.
-         */
+        // Fix up the gosubs that might have been emitted before non-local
+        // jumps to the finally code.
         if (!BackPatch(cx, bce, stmtInfo.gosubs(), bce->code().end(), JSOP_GOSUB))
             return false;
 
         finallyStart = bce->offset();
 
-        /* Indicate that we're emitting a subroutine body. */
+        // Indicate that we're emitting a subroutine body.
         stmtInfo.type = STMT_SUBROUTINE;
         if (!UpdateSourceCoordNotes(cx, bce, pn->pn_kid3->pn_pos.begin))
             return false;
@@ -4055,26 +4038,22 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    /* ReconstructPCStack needs a NOP here to mark the end of the last catch block. */
+    // ReconstructPCStack needs a NOP here to mark the end of the last catch block.
     if (Emit1(cx, bce, JSOP_NOP) < 0)
         return false;
 
-    /* Fix up the end-of-try/catch jumps to come here. */
+    // Fix up the end-of-try/catch jumps to come here.
     if (!BackPatch(cx, bce, catchJump, bce->code().end(), JSOP_GOTO))
         return false;
 
-    /*
-     * Add the try note last, to let post-order give us the right ordering
-     * (first to last for a given nesting level, inner to outer by level).
-     */
+    // Add the try note last, to let post-order give us the right ordering
+    // (first to last for a given nesting level, inner to outer by level).
     if (pn->pn_kid2 && !bce->tryNoteList.append(JSTRY_CATCH, depth, tryStart, tryEnd))
         return false;
 
-    /*
-     * If we've got a finally, mark try+catch region with additional
-     * trynote to catch exceptions (re)thrown from a catch block or
-     * for the try{}finally{} case.
-     */
+    // If we've got a finally, mark try+catch region with additional
+    // trynote to catch exceptions (re)thrown from a catch block or
+    // for the try{}finally{} case.
     if (pn->pn_kid3 && !bce->tryNoteList.append(JSTRY_FINALLY, depth, tryStart, finallyStart))
         return false;
 
@@ -6890,6 +6869,16 @@ CGObjectList::finish(ObjectArray *array)
     JS_ASSERT(cursor == array->vector);
 }
 
+ObjectBox*
+CGObjectList::find(uint32_t index)
+{
+    JS_ASSERT(index < length);
+    ObjectBox *box = lastbox;
+    for (unsigned n = length - 1; n > index; n--)
+        box = box->emitLink;
+    return box;
+}
+
 bool
 CGTryNoteList::append(JSTryNoteKind kind, unsigned stackDepth, size_t start, size_t end)
 {
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index 3473a034e831..54b000774289 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -46,6 +46,7 @@ struct CGObjectList {
     unsigned add(ObjectBox *objbox);
     unsigned indexOf(JSObject *obj);
     void finish(ObjectArray *array);
+    ObjectBox* find(uint32_t index);
 };
 
 struct CGTryNoteList {

From 46f0c8499407813a309fc245b46dfa62066be443 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 10:13:59 +0100
Subject: [PATCH 072/144] Bug 927782 - Part 6: Fix for-let nesting so nonlocal
 exits are easier. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 48 +++++++----------------------
 1 file changed, 11 insertions(+), 37 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 569cc37067b5..0d45a65c126b 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -577,35 +577,11 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
 
         if (stmt->isBlockScope) {
             FLUSH_POPS();
-            unsigned blockObjCount = stmt->blockObj->slotCount();
-            if (stmt->isForLetBlock) {
-                /*
-                 * For a for-let-in/of statement, pushing/popping the block is
-                 * interleaved with JSOP_(END)ITER. Just handle both together
-                 * here and skip over the enclosing STMT_FOR_IN_LOOP.
-                 */
-                unsigned popCount = blockObjCount;
-                stmt = stmt->down;
-                if (stmt == toStmt)
-                    break;
-                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-                    return false;
-                if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
-                    return false;
-                if (stmt->type == STMT_FOR_OF_LOOP) {
-                    popCount += 2;
-                } else {
-                    JS_ASSERT(stmt->type == STMT_FOR_IN_LOOP);
-                    if (!PopIterator(cx, bce))
-                        return false;
-                }
-                EMIT_UINT16_IMM_OP(JSOP_POPN, popCount);
-            } else {
-                /* There is a Block object with locals on the stack to pop. */
-                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-                    return false;
-                EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
-            }
+            JS_ASSERT(stmt->blockObj);
+            StaticBlockObject &blockObj = *stmt->blockObj;
+            if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                return false;
+            EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
         }
     }
 
@@ -4269,9 +4245,6 @@ EmitWith(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 static bool
 EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    StmtInfoBCE stmtInfo(cx);
-    PushStatementBCE(bce, &stmtInfo, STMT_FOR_OF_LOOP, top);
-
     ParseNode *forHead = pn->pn_left;
     ParseNode *forBody = pn->pn_right;
 
@@ -4328,11 +4301,13 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
             return false;
-        letStmt.isForLetBlock = true;
         if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET2))
             return false;
     }
 
+    StmtInfoBCE stmtInfo(cx);
+    PushStatementBCE(bce, &stmtInfo, STMT_FOR_OF_LOOP, top);
+
     // Jump down to the loop condition to minimize overhead assuming at least
     // one iteration, as the other loop forms do.  Annotate so IonMonkey can
     // find the loop-closing jump.
@@ -4436,9 +4411,6 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
 static bool
 EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    StmtInfoBCE stmtInfo(cx);
-    PushStatementBCE(bce, &stmtInfo, STMT_FOR_IN_LOOP, top);
-
     ParseNode *forHead = pn->pn_left;
     ParseNode *forBody = pn->pn_right;
 
@@ -4507,11 +4479,13 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
             return false;
-        letStmt.isForLetBlock = true;
         if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET1))
             return false;
     }
 
+    StmtInfoBCE stmtInfo(cx);
+    PushStatementBCE(bce, &stmtInfo, STMT_FOR_IN_LOOP, top);
+
     /* Annotate so IonMonkey can find the loop-closing jump. */
     int noteIndex = NewSrcNote(cx, bce, SRC_FOR_IN);
     if (noteIndex < 0)

From 3b8c9f30e6e61db37850960ee3199a4b36e38b85 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:25:55 +0100
Subject: [PATCH 073/144] Bug 927782 - Part 7: Refactor entering and leaving
 block scopes in BytecodeEmitter. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 362 ++++++++++++++--------------
 js/src/jit/BaselineBailouts.cpp     |   1 -
 js/src/vm/Interpreter.cpp           |   4 +-
 3 files changed, 178 insertions(+), 189 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 0d45a65c126b..81529e9c0de7 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -142,11 +142,12 @@ EmitCheck(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t delta)
 }
 
 static StaticBlockObject &
-CurrentBlock(StmtInfoBCE *topStmt)
+LastBlockAdded(BytecodeEmitter *bce, jsbytecode *pc)
 {
-    JS_ASSERT(topStmt->type == STMT_BLOCK || topStmt->type == STMT_SWITCH);
-    JS_ASSERT(topStmt->blockObj->is<StaticBlockObject>());
-    return *topStmt->blockObj;
+    DebugOnly<uint32_t> index = GET_UINT32_INDEX(pc);
+    JS_ASSERT(index < bce->objectList.length);
+    JS_ASSERT(index == bce->objectList.length - 1);
+    return bce->objectList.lastbox->object->as<StaticBlockObject>();
 }
 
 static void
@@ -176,13 +177,13 @@ UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)
     int nuses, ndefs;
     if (op == JSOP_ENTERBLOCK) {
         nuses = 0;
-        ndefs = CurrentBlock(bce->topStmt).slotCount();
+        ndefs = LastBlockAdded(bce, pc).slotCount();
     } else if (op == JSOP_ENTERLET0) {
-        nuses = ndefs = CurrentBlock(bce->topStmt).slotCount();
+        nuses = ndefs = LastBlockAdded(bce, pc).slotCount();
     } else if (op == JSOP_ENTERLET1) {
-        nuses = ndefs = CurrentBlock(bce->topStmt).slotCount() + 1;
+        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 1;
     } else if (op == JSOP_ENTERLET2) {
-        nuses = ndefs = CurrentBlock(bce->topStmt).slotCount() + 2;
+        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 2;
     } else {
         nuses = StackUses(nullptr, pc);
         ndefs = StackDefs(nullptr, pc);
@@ -653,10 +654,80 @@ EnclosingStaticScope(BytecodeEmitter *bce)
     return bce->sc->asFunctionBox()->function();
 }
 
-// Push a block scope statement and link blockObj into bce->blockChain.
+// In a stack frame, block-scoped locals follow hoisted var-bound locals.  If
+// the current compilation unit is a function, add the number of "fixed slots"
+// (var-bound locals) to the given block-scoped index, to arrive at its final
+// position in the call frame.
+//
 static bool
-PushBlockScopeBCE(BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
-                  ptrdiff_t top)
+AdjustBlockSlot(ExclusiveContext *cx, BytecodeEmitter *bce, uint32_t *slot)
+{
+    JS_ASSERT(*slot < bce->maxStackDepth);
+    if (bce->sc->isFunctionBox()) {
+        *slot += bce->script->bindings.numVars();
+        if ((unsigned) *slot >= SLOTNO_LIMIT) {
+            bce->reportError(nullptr, JSMSG_TOO_MANY_LOCALS);
+            return false;
+        }
+    }
+    return true;
+}
+
+#ifdef DEBUG
+static bool
+AllLocalsAliased(StaticBlockObject &obj)
+{
+    for (unsigned i = 0; i < obj.slotCount(); i++)
+        if (!obj.isAliased(i))
+            return false;
+    return true;
+}
+#endif
+
+static bool
+ComputeAliasedSlots(ExclusiveContext *cx, BytecodeEmitter *bce, StaticBlockObject &blockObj)
+{
+    uint32_t depthPlusFixed = blockObj.stackDepth();
+    if (!AdjustBlockSlot(cx, bce, &depthPlusFixed))
+        return false;
+
+    for (unsigned i = 0; i < blockObj.slotCount(); i++) {
+        Definition *dn = blockObj.maybeDefinitionParseNode(i);
+
+        /* Beware the empty destructuring dummy. */
+        if (!dn) {
+            blockObj.setAliased(i, bce->sc->allLocalsAliased());
+            continue;
+        }
+
+        JS_ASSERT(dn->isDefn());
+        JS_ASSERT(dn->frameSlot() + depthPlusFixed < JS_BIT(16));
+        if (!dn->pn_cookie.set(bce->parser->tokenStream, dn->pn_cookie.level(),
+                               uint16_t(dn->frameSlot() + depthPlusFixed)))
+            return false;
+
+#ifdef DEBUG
+        for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
+            JS_ASSERT(pnu->pn_lexdef == dn);
+            JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));
+            JS_ASSERT(pnu->pn_cookie.isFree());
+        }
+#endif
+
+        blockObj.setAliased(i, bce->isAliasedName(dn));
+    }
+
+    JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(blockObj));
+
+    return true;
+}
+
+static bool
+EmitInternedObjectOp(ExclusiveContext *cx, uint32_t index, JSOp op, BytecodeEmitter *bce);
+
+static bool
+EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
+                unsigned extraSlots)
 {
     uint32_t parent = UINT32_MAX;
     if (bce->blockChain) {
@@ -667,16 +738,35 @@ PushBlockScopeBCE(BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
 
     StaticBlockObject &blockObj = objbox->object->as<StaticBlockObject>();
 
-    PushStatementBCE(bce, stmt, STMT_BLOCK, top);
-
-    unsigned scopeObjectIndex = bce->objectList.add(objbox);
+    uint32_t scopeObjectIndex = bce->objectList.add(objbox);
     stmt->blockScopeIndex = bce->blockScopeList.length();
     if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
         return false;
 
+    int depth = bce->stackDepth - (blockObj.slotCount() + extraSlots);
+    JS_ASSERT(depth >= 0);
+    blockObj.setStackDepth(depth);
+
+    JSOp op;
+    switch (extraSlots) {
+      case 0: op = JSOP_ENTERLET0; break;
+      case 1: op = JSOP_ENTERLET1; break;
+      case 2: op = JSOP_ENTERLET2; break;
+      default: MOZ_ASSUME_UNREACHABLE("unexpected extraSlots");
+    }
+
+    if (!ComputeAliasedSlots(cx, bce, blockObj))
+        return false;
+
+    if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
+        return false;
+
+    PushStatementBCE(bce, stmt, STMT_BLOCK, bce->offset());
     blockObj.initEnclosingStaticScope(EnclosingStaticScope(bce));
     FinishPushBlockScope(bce, stmt, blockObj);
 
+    JS_ASSERT(stmt->isBlockScope);
+
     return true;
 }
 
@@ -700,6 +790,35 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
     return true;
 }
 
+static bool
+LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
+{
+#ifdef DEBUG
+    StmtInfoBCE *stmt = bce->topStmt;
+    uint32_t blockScopeIndex = stmt->blockScopeIndex;
+    JS_ASSERT(stmt->isBlockScope);
+    JS_ASSERT(bce->blockScopeList.list[blockScopeIndex].length == 0);
+    uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
+    ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
+    StaticBlockObject *blockObj = &blockObjBox->object->as<StaticBlockObject>();
+    JS_ASSERT(stmt->blockObj == blockObj);
+    JS_ASSERT(blockObj == bce->blockChain);
+#endif
+
+    uint32_t slotCount = bce->blockChain->slotCount();
+
+    if (!PopStatementBCE(cx, bce))
+        return false;
+
+    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        return false;
+
+    JS_ASSERT(op == JSOP_LEAVEBLOCK || op == JSOP_LEAVEBLOCKEXPR);
+    EMIT_UINT16_IMM_OP(op, slotCount);
+
+    return true;
+}
+
 static bool
 EmitIndex32(ExclusiveContext *cx, JSOp op, uint32_t index, BytecodeEmitter *bce)
 {
@@ -1032,101 +1151,6 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
     return false;
 }
 
-/*
- * Adjust the slot for a block local to account for the number of variables
- * that share the same index space with locals. Due to the incremental code
- * generation for top-level script, we do the adjustment via code patching in
- * js::frontend::CompileScript; see comments there.
- *
- * The function returns -1 on failures.
- */
-static int
-AdjustBlockSlot(ExclusiveContext *cx, BytecodeEmitter *bce, int slot)
-{
-    JS_ASSERT((unsigned) slot < bce->maxStackDepth);
-    if (bce->sc->isFunctionBox()) {
-        slot += bce->script->bindings.numVars();
-        if ((unsigned) slot >= SLOTNO_LIMIT) {
-            bce->reportError(nullptr, JSMSG_TOO_MANY_LOCALS);
-            slot = -1;
-        }
-    }
-    return slot;
-}
-
-#ifdef DEBUG
-static bool
-AllLocalsAliased(StaticBlockObject &obj)
-{
-    for (unsigned i = 0; i < obj.slotCount(); i++)
-        if (!obj.isAliased(i))
-            return false;
-    return true;
-}
-#endif
-
-static bool
-EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp op)
-{
-    JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
-    StmtInfoBCE *stmt = bce->topStmt;
-    JS_ASSERT(stmt->type == STMT_BLOCK || stmt->type == STMT_SWITCH);
-    JS_ASSERT(stmt->isBlockScope);
-    JS_ASSERT(stmt->blockScopeIndex == bce->blockScopeList.length() - 1);
-    JS_ASSERT(bce->blockScopeList.list[stmt->blockScopeIndex].length == 0);
-    uint32_t scopeObjectIndex = bce->blockScopeList.list[stmt->blockScopeIndex].index;
-    JS_ASSERT(scopeObjectIndex == bce->objectList.length - 1);
-    JS_ASSERT(pn->pn_objbox == bce->objectList.lastbox);
-    if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
-        return false;
-
-    Rooted<StaticBlockObject*> blockObj(cx, &pn->pn_objbox->object->as<StaticBlockObject>());
-
-    int extraSlots = (op == JSOP_ENTERLET1)
-                     ? 1
-                     : (op == JSOP_ENTERLET2)
-                     ? 2
-                     : 0;
-    int depth = bce->stackDepth - (blockObj->slotCount() + extraSlots);
-    JS_ASSERT(depth >= 0);
-
-    blockObj->setStackDepth(depth);
-
-    int depthPlusFixed = AdjustBlockSlot(cx, bce, depth);
-    if (depthPlusFixed < 0)
-        return false;
-
-    for (unsigned i = 0; i < blockObj->slotCount(); i++) {
-        Definition *dn = blockObj->maybeDefinitionParseNode(i);
-
-        /* Beware the empty destructuring dummy. */
-        if (!dn) {
-            blockObj->setAliased(i, bce->sc->allLocalsAliased());
-            continue;
-        }
-
-        JS_ASSERT(dn->isDefn());
-        JS_ASSERT(unsigned(dn->frameSlot() + depthPlusFixed) < JS_BIT(16));
-        if (!dn->pn_cookie.set(bce->parser->tokenStream, dn->pn_cookie.level(),
-                               uint16_t(dn->frameSlot() + depthPlusFixed)))
-            return false;
-
-#ifdef DEBUG
-        for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
-            JS_ASSERT(pnu->pn_lexdef == dn);
-            JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));
-            JS_ASSERT(pnu->pn_cookie.isFree());
-        }
-#endif
-
-        blockObj->setAliased(i, bce->isAliasedName(dn));
-    }
-
-    JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(*blockObj));
-
-    return true;
-}
-
 /*
  * Try to convert a *NAME op with a free name to a more specialized GNAME,
  * INTRINSIC or ALIASEDVAR op, which optimize accesses on that name.
@@ -2299,7 +2323,6 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     int noteIndex;
     size_t switchSize;
     jsbytecode *pc;
-    StmtInfoBCE stmtInfo(cx);
 
     /* Try for most optimal, fall back if not dense ints. */
     switchOp = JSOP_TABLESWITCH;
@@ -2307,14 +2330,16 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     defaultOffset = -1;
 
     pn2 = pn->pn_right;
+    JS_ASSERT(pn2->isKind(PNK_LEXICALSCOPE) || pn2->isKind(PNK_STATEMENTLIST));
+
     /*
      * If there are hoisted let declarations, their stack slots go under the
      * discriminant's value so push their slots now and enter the block later.
      */
-    uint32_t blockObjCount = 0;
+    StaticBlockObject *blockObj = nullptr;
     if (pn2->isKind(PNK_LEXICALSCOPE)) {
-        blockObjCount = pn2->pn_objbox->object->as<StaticBlockObject>().slotCount();
-        for (uint32_t i = 0; i < blockObjCount; ++i) {
+        blockObj = &pn2->pn_objbox->object->as<StaticBlockObject>();
+        for (uint32_t i = 0; i < blockObj->slotCount(); ++i) {
             if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
                 return false;
         }
@@ -2324,29 +2349,21 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!EmitTree(cx, bce, pn->pn_left))
         return false;
 
+    StmtInfoBCE stmtInfo(cx);
     if (pn2->isKind(PNK_LEXICALSCOPE)) {
-        if (!PushBlockScopeBCE(bce, &stmtInfo, pn2->pn_objbox, -1))
+        if (!EnterBlockScope(cx, bce, &stmtInfo, pn2->pn_objbox, 1))
             return false;
         stmtInfo.type = STMT_SWITCH;
-        if (!EmitEnterBlock(cx, bce, pn2, JSOP_ENTERLET1))
-            return false;
+        stmtInfo.update = top = bce->offset();
+        /* Advance pn2 to refer to the switch case list. */
+        pn2 = pn2->expr();
+    } else {
+        JS_ASSERT(pn2->isKind(PNK_STATEMENTLIST));
+        top = bce->offset();
+        PushStatementBCE(bce, &stmtInfo, STMT_SWITCH, top);
     }
 
     /* Switch bytecodes run from here till end of final case. */
-    top = bce->offset();
-    if (pn2->isKind(PNK_STATEMENTLIST)) {
-        PushStatementBCE(bce, &stmtInfo, STMT_SWITCH, top);
-    } else {
-        /*
-         * Set the statement info record's idea of top. Reset top too, since
-         * repushBlock emits code.
-         */
-        stmtInfo.update = top = bce->offset();
-
-        /* Advance pn2 to refer to the switch case list. */
-        pn2 = pn2->expr();
-    }
-
     uint32_t caseCount = pn2->pn_count;
     uint32_t tableLength = 0;
     ScopedJSFreePtr<ParseNode*> table(nullptr);
@@ -2618,13 +2635,13 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
     }
 
-    if (!PopStatementBCE(cx, bce))
-        return false;
 
     if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+            return false;
+    } else {
+        if (!PopStatementBCE(cx, bce))
             return false;
-        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
     }
 
     return true;
@@ -3139,8 +3156,8 @@ EmitGroupAssignment(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
     for (pn = lhs->pn_head; pn; pn = pn->pn_next, ++i) {
         /* MaybeEmitGroupAssignment requires lhs->pn_count <= rhs->pn_count. */
         JS_ASSERT(i < limit);
-        int slot = AdjustBlockSlot(cx, bce, i);
-        if (slot < 0)
+        uint32_t slot = i;
+        if (!AdjustBlockSlot(cx, bce, &slot))
             return false;
 
         if (!EmitUnaliasedVarOp(cx, JSOP_GETLOCAL, slot, bce))
@@ -4173,26 +4190,16 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     }
 
     StmtInfoBCE stmtInfo(cx);
-    if (!PushBlockScopeBCE(bce, &stmtInfo, letBody->pn_objbox, bce->offset()))
-        return false;
-
-    DebugOnly<ptrdiff_t> bodyBegin = bce->offset();
-    if (!EmitEnterBlock(cx, bce, letBody, JSOP_ENTERLET0))
+    if (!EnterBlockScope(cx, bce, &stmtInfo, letBody->pn_objbox, 0))
         return false;
 
     if (!EmitTree(cx, bce, letBody->pn_expr))
         return false;
 
-    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+    if (!LeaveBlockScope(cx, bce, letBody->getOp()))
         return false;
-    JSOp leaveOp = letBody->getOp();
-    JS_ASSERT(leaveOp == JSOP_LEAVEBLOCK || leaveOp == JSOP_LEAVEBLOCKEXPR);
-    EMIT_UINT16_IMM_OP(leaveOp, blockObj->slotCount());
 
-    DebugOnly<ptrdiff_t> bodyEnd = bce->offset();
-    JS_ASSERT(bodyEnd > bodyBegin);
-
-    return PopStatementBCE(cx, bce);
+    return true;
 }
 
 /*
@@ -4209,20 +4216,22 @@ EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     ObjectBox *objbox = pn->pn_objbox;
     StaticBlockObject &blockObj = objbox->object->as<StaticBlockObject>();
     size_t slots = blockObj.slotCount();
-    if (!PushBlockScopeBCE(bce, &stmtInfo, objbox, bce->offset()))
-        return false;
 
-    if (!EmitEnterBlock(cx, bce, pn, JSOP_ENTERBLOCK))
+    for (size_t n = 0; n < slots; ++n) {
+        if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
+            return false;
+    }
+
+    if (!EnterBlockScope(cx, bce, &stmtInfo, objbox, 0))
         return false;
 
     if (!EmitTree(cx, bce, pn->pn_expr))
         return false;
 
-    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+    if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
         return false;
-    EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, slots);
 
-    return PopStatementBCE(cx, bce);
+    return true;
 }
 
 static bool
@@ -4299,9 +4308,7 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     // Enter the block before the loop body, after evaluating the obj.
     StmtInfoBCE letStmt(cx);
     if (letDecl) {
-        if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
-            return false;
-        if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET2))
+        if (!EnterBlockScope(cx, bce, &letStmt, pn1->pn_objbox, 2))
             return false;
     }
 
@@ -4393,18 +4400,14 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (!PopStatementBCE(cx, bce))
         return false;
 
+    // Pop result and iter.
+    EMIT_UINT16_IMM_OP(JSOP_POPN, 2);
+
     if (letDecl) {
-        if (!PopStatementBCE(cx, bce))
-            return false;
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-            return false;
-        if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
+        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
             return false;
     }
 
-    // Pop result, iter, and slots from the lexical block (if any).
-    EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount + 2);
-
     return true;
 }
 
@@ -4477,9 +4480,7 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     /* Enter the block before the loop body, after evaluating the obj. */
     StmtInfoBCE letStmt(cx);
     if (letDecl) {
-        if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
-            return false;
-        if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET1))
+        if (!EnterBlockScope(cx, bce, &letStmt, pn1->pn_objbox, 1))
             return false;
     }
 
@@ -4549,26 +4550,19 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (!SetSrcNoteOffset(cx, bce, (unsigned)noteIndex, 0, beq - jmp))
         return false;
 
-    /* Fixup breaks and continues before JSOP_ITER (and JSOP_LEAVEFORINLET). */
+    // Fix up breaks and continues.
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    if (letDecl) {
-        if (!PopStatementBCE(cx, bce))
-            return false;
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-            return false;
-        if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
-            return false;
-    }
-
     if (!bce->tryNoteList.append(JSTRY_ITER, bce->stackDepth, top, bce->offset()))
         return false;
     if (Emit1(cx, bce, JSOP_ENDITER) < 0)
         return false;
 
-    if (letDecl)
-        EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount);
+    if (letDecl) {
+        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+            return false;
+    }
 
     return true;
 }
@@ -6432,8 +6426,6 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
        return false;
 
       case PNK_ARRAYPUSH: {
-        int slot;
-
         /*
          * The array object's stack index is in bce->arrayCompDepth. See below
          * under the array initialiser code generator for array comprehension
@@ -6442,8 +6434,8 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
          */
         if (!EmitTree(cx, bce, pn->pn_kid))
             return false;
-        slot = AdjustBlockSlot(cx, bce, bce->arrayCompDepth);
-        if (slot < 0)
+        uint32_t slot = bce->arrayCompDepth;
+        if (!AdjustBlockSlot(cx, bce, &slot))
             return false;
         if (!EmitUnaliasedVarOp(cx, pn->getOp(), slot, bce))
             return false;
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index d2fccb1da4fa..9fd0fc07fc10 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -666,7 +666,6 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
     bool resumeAfter = excInfo ? false : iter.resumeAfter();
 
     JSOp op = JSOp(*pc);
-    JS_ASSERT_IF(excInfo, op == JSOP_ENTERBLOCK);
 
     // Fixup inlined JSOP_FUNCALL, JSOP_FUNAPPLY, and accessors on the caller side.
     // On the caller side this must represent like the function wasn't inlined.
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index e076291e5b2a..0ea4658a9817 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3377,10 +3377,8 @@ DEFAULT()
 
             switch (tn->kind) {
               case JSTRY_CATCH:
-                JS_ASSERT(*REGS.pc == JSOP_ENTERBLOCK || *REGS.pc == JSOP_EXCEPTION);
-
                 /* Catch cannot intercept the closing of a generator. */
-                  if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
+                if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
                     break;
 
                 /*

From e1f6dcf132f54d2399a56fa8740342b8389cd068 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:27:55 +0100
Subject: [PATCH 074/144] Bug 927782 - Part 8: Record block scope ranges more
 precisely. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 164 ++++++++++++++++++++--------
 js/src/frontend/BytecodeEmitter.h   |   1 +
 js/src/jsscript.cpp                 |   5 +-
 js/src/jsscript.h                   |  22 +++-
 js/src/vm/ScopeObject.cpp           |   1 +
 5 files changed, 142 insertions(+), 51 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 81529e9c0de7..e69e982252ef 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -523,19 +523,65 @@ PopIterator(ExclusiveContext *cx, BytecodeEmitter *bce)
     return true;
 }
 
+namespace {
+
+class NonLocalExitScope {
+    ExclusiveContext *cx;
+    BytecodeEmitter *bce;
+    const uint32_t savedScopeIndex;
+    const int savedDepth;
+    uint32_t openScopeIndex;
+
+    NonLocalExitScope(const NonLocalExitScope &) MOZ_DELETE;
+
+  public:
+    explicit NonLocalExitScope(ExclusiveContext *cx_, BytecodeEmitter *bce_)
+      : cx(cx_),
+        bce(bce_),
+        savedScopeIndex(bce->blockScopeList.length()),
+        savedDepth(bce->stackDepth),
+        openScopeIndex(UINT32_MAX) {
+        if (bce->blockChain) {
+            StmtInfoBCE *stmt = bce->topStmt;
+            while (1) {
+                JS_ASSERT(stmt);
+                if (stmt->isBlockScope) {
+                    openScopeIndex = stmt->blockScopeIndex;
+                    break;
+                }
+                stmt = stmt->down;
+            }
+        }
+    }
+
+    ~NonLocalExitScope() {
+        for (uint32_t n = savedScopeIndex; n < bce->blockScopeList.length(); n++)
+            bce->blockScopeList.recordEnd(n, bce->offset());
+        bce->stackDepth = savedDepth;
+    }
+
+    bool popScopeForNonLocalExit(StaticBlockObject &blockObj, uint32_t blockScopeIndex) {
+        uint32_t scopeObjectIndex = bce->blockScopeList.findEnclosingScope(blockScopeIndex);
+        uint32_t parent = openScopeIndex;
+
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
+        if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
+            return false;
+        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
+        openScopeIndex = bce->blockScopeList.length() - 1;
+        return true;
+    }
+
+    bool prepareForNonLocalJump(StmtInfoBCE *toStmt);
+};
+
 /*
  * Emit additional bytecode(s) for non-local jumps.
  */
-static bool
-EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *toStmt)
+bool
+NonLocalExitScope::prepareForNonLocalJump(StmtInfoBCE *toStmt)
 {
-    /*
-     * The non-local jump fixup we emit will unbalance bce->stackDepth, because
-     * the fixup replicates balanced code such as JSOP_LEAVEWITH emitted at the
-     * end of a with statement, so we save bce->stackDepth here and restore it
-     * just before a successful return.
-     */
-    int depth = bce->stackDepth;
     int npops = 0;
 
 #define FLUSH_POPS() if (npops && !FlushPops(cx, bce, &npops)) return false
@@ -580,24 +626,26 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
             FLUSH_POPS();
             JS_ASSERT(stmt->blockObj);
             StaticBlockObject &blockObj = *stmt->blockObj;
-            if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            if (!popScopeForNonLocalExit(blockObj, stmt->blockScopeIndex))
                 return false;
-            EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
         }
     }
 
     FLUSH_POPS();
-    bce->stackDepth = depth;
     return true;
 
 #undef FLUSH_POPS
 }
 
+}  // anonymous namespace
+
 static ptrdiff_t
 EmitGoto(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *toStmt, ptrdiff_t *lastp,
          SrcNoteType noteType = SRC_NULL)
 {
-    if (!EmitNonLocalJumpFixup(cx, bce, toStmt))
+    NonLocalExitScope nle(cx, bce);
+
+    if (!nle.prepareForNonLocalJump(toStmt))
         return -1;
 
     if (noteType != SRC_NULL) {
@@ -729,7 +777,7 @@ static bool
 EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
                 unsigned extraSlots)
 {
-    uint32_t parent = UINT32_MAX;
+    uint32_t parent = BlockScopeNote::NoBlockScopeIndex;
     if (bce->blockChain) {
         StmtInfoBCE *stmt = bce->topScopeStmt;
         for (; stmt->blockObj != bce->blockChain; stmt = stmt->down) {}
@@ -739,9 +787,6 @@ EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, O
     StaticBlockObject &blockObj = objbox->object->as<StaticBlockObject>();
 
     uint32_t scopeObjectIndex = bce->objectList.add(objbox);
-    stmt->blockScopeIndex = bce->blockScopeList.length();
-    if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
-        return false;
 
     int depth = bce->stackDepth - (blockObj.slotCount() + extraSlots);
     JS_ASSERT(depth >= 0);
@@ -761,6 +806,10 @@ EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, O
     if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
         return false;
 
+    stmt->blockScopeIndex = bce->blockScopeList.length();
+    if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
+        return false;
+
     PushStatementBCE(bce, stmt, STMT_BLOCK, bce->offset());
     blockObj.initEnclosingStaticScope(EnclosingStaticScope(bce));
     FinishPushBlockScope(bce, stmt, blockObj);
@@ -783,9 +832,6 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
         return false;
     }
 
-    if (stmt->isBlockScope)
-        bce->blockScopeList.recordEnd(stmt->blockScopeIndex, bce->offset());
-
     FinishPopStatement(bce);
     return true;
 }
@@ -793,10 +839,11 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
 static bool
 LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
 {
-#ifdef DEBUG
     StmtInfoBCE *stmt = bce->topStmt;
-    uint32_t blockScopeIndex = stmt->blockScopeIndex;
     JS_ASSERT(stmt->isBlockScope);
+    uint32_t blockScopeIndex = stmt->blockScopeIndex;
+
+#ifdef DEBUG
     JS_ASSERT(bce->blockScopeList.list[blockScopeIndex].length == 0);
     uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
     ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
@@ -813,6 +860,8 @@ LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
     if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
         return false;
 
+    bce->blockScopeList.recordEnd(blockScopeIndex, bce->offset());
+
     JS_ASSERT(op == JSOP_LEAVEBLOCK || op == JSOP_LEAVEBLOCKEXPR);
     EMIT_UINT16_IMM_OP(op, slotCount);
 
@@ -3845,35 +3894,26 @@ EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         if (guardCheck < 0)
             return false;
 
-#ifdef DEBUG
-        uint32_t blockScopeIndex = bce->topStmt->blockScopeIndex;
-        uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
-        ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
-        StaticBlockObject *blockObj = &blockObjBox->object->as<StaticBlockObject>();
-        JS_ASSERT(blockObj == bce->blockChain);
-#endif
+        {
+            NonLocalExitScope nle(cx, bce);
 
-        // Save stack depth before popping the block scope.
-        int savedDepth = bce->stackDepth;
+            // Move exception back to cx->exception to prepare for
+            // the next catch.
+            if (Emit1(cx, bce, JSOP_THROWING) < 0)
+                return false;
 
-        // Move exception back to cx->exception to prepare for
-        // the next catch.
-        if (Emit1(cx, bce, JSOP_THROWING) < 0)
-            return false;
+            // Leave the scope for this catch block.
+            if (!nle.prepareForNonLocalJump(stmt))
+                return false;
 
-        // Leave the scope for this catch block
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-            return false;
-        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, bce->blockChain->slotCount());
+            // Jump to the next handler.  The jump target is backpatched by EmitTry.
+            ptrdiff_t guardJump = EmitJump(cx, bce, JSOP_GOTO, 0);
+            if (guardJump < 0)
+                return false;
+            stmt->guardJump() = guardJump;
+        }
 
-        // Jump to the next handler.  The jump target is backpatched by EmitTry.
-        ptrdiff_t guardJump = EmitJump(cx, bce, JSOP_GOTO, 0);
-        if (guardJump < 0)
-            return false;
-        stmt->guardJump() = guardJump;
-
-        // Back to normal control flow. restore stack depth after nonlocal exit.
-        bce->stackDepth = savedDepth;
+        // Back to normal control flow.
         SetJumpOffsetAt(bce, guardCheck);
 
         // Pop duplicated exception object as we no longer need it.
@@ -5066,8 +5106,12 @@ EmitReturn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     if (Emit1(cx, bce, JSOP_RETURN) < 0)
         return false;
-    if (!EmitNonLocalJumpFixup(cx, bce, nullptr))
+
+    NonLocalExitScope nle(cx, bce);
+
+    if (!nle.prepareForNonLocalJump(nullptr))
         return false;
+
     if (top + JSOP_RETURN_LENGTH != bce->offset()) {
         bce->code()[top] = JSOP_SETRVAL;
         if (Emit1(cx, bce, JSOP_RETRVAL) < 0)
@@ -6884,6 +6928,30 @@ CGBlockScopeList::append(uint32_t scopeObject, uint32_t offset, uint32_t parent)
     return list.append(note);
 }
 
+uint32_t
+CGBlockScopeList::findEnclosingScope(uint32_t index)
+{
+    JS_ASSERT(index < length());
+    JS_ASSERT(list[index].index != BlockScopeNote::NoBlockScopeIndex);
+
+    DebugOnly<uint32_t> pos = list[index].start;
+    while (index--) {
+        JS_ASSERT(list[index].start <= pos);
+        if (list[index].length == 0) {
+            // We are looking for the nearest enclosing live scope.  If the
+            // scope contains POS, it should still be open, so its length should
+            // be zero.
+            return list[index].index;
+        } else {
+            // Conversely, if the length is not zero, it should not contain
+            // POS.
+            JS_ASSERT(list[index].start + list[index].length <= pos);
+        }
+    }
+
+    return BlockScopeNote::NoBlockScopeIndex;
+}
+
 void
 CGBlockScopeList::recordEnd(uint32_t index, uint32_t offset)
 {
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index 54b000774289..0ee9667b812b 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -63,6 +63,7 @@ struct CGBlockScopeList {
     CGBlockScopeList(ExclusiveContext *cx) : list(cx) {}
 
     bool append(uint32_t scopeObject, uint32_t offset, uint32_t parent);
+    uint32_t findEnclosingScope(uint32_t index);
     void recordEnd(uint32_t index, uint32_t offset);
     size_t length() const { return list.length(); }
     void finish(BlockScopeArray *array);
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index b94db57d618e..7c25e8dbabe8 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -2930,7 +2930,10 @@ JSScript::getBlockScope(jsbytecode *pc)
                 if (offset < checkNote->start + checkNote->length) {
                     // We found a matching block chain but there may be inner ones
                     // at a higher block chain index than mid. Continue the binary search.
-                    blockChain = &getObject(checkNote->index)->as<StaticBlockObject>();
+                    if (checkNote->index == BlockScopeNote::NoBlockScopeIndex)
+                        blockChain = nullptr;
+                    else
+                        blockChain = &getObject(checkNote->index)->as<StaticBlockObject>();
                     break;
                 }
                 if (checkNote->parent == UINT32_MAX)
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 09d88c489bdc..93c309e498ca 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -82,9 +82,27 @@ struct JSTryNote {
 
 namespace js {
 
+// A block scope has a range in bytecode: it is entered at some offset, and left
+// at some later offset.  Scopes can be nested.  Given an offset, the
+// BlockScopeNote containing that offset whose with the highest start value
+// indicates the block scope.  The block scope list is sorted by increasing
+// start value.
+//
+// It is possible to leave a scope nonlocally, for example via a "break"
+// statement, so there may be short bytecode ranges in a block scope in which we
+// are popping the block chain in preparation for a goto.  These exits are also
+// nested with respect to outer scopes.  The scopes in these exits are indicated
+// by the "index" field, just like any other block.  If a nonlocal exit pops the
+// last block scope, the index will be NoBlockScopeIndex.
+//
 struct BlockScopeNote {
-    uint32_t        index;      // Index of StaticScopeObject in the object array.
-    uint32_t        start;      // Bytecode offset at which this scope starts.
+    static const uint32_t NoBlockScopeIndex = UINT32_MAX;
+
+    uint32_t        index;      // Index of StaticScopeObject in the object
+                                // array, or NoBlockScopeIndex if there is no
+                                // block scope in this range.
+    uint32_t        start;      // Bytecode offset at which this scope starts,
+                                // from script->main().
     uint32_t        length;     // Bytecode length of scope.
     uint32_t        parent;     // Index of parent block scope in notes, or UINT32_MAX.
 };
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 95e31570278c..ae8ea9799178 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -50,6 +50,7 @@ js::ScopeCoordinateToStaticScopeShape(JSScript *script, jsbytecode *pc)
     StaticScopeIter<NoGC> ssi(InnermostStaticScope(script, pc));
     ScopeCoordinate sc(pc);
     while (true) {
+        JS_ASSERT(!ssi.done());
         if (ssi.hasDynamicScopeObject()) {
             if (!sc.hops)
                 break;

From bbd69751e9606f8c338036a3a7bfd65a07ff9d91 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:30:05 +0100
Subject: [PATCH 075/144] Bug 927782 - Part 9: Fix js_DumpScriptDepth to not
 abort on unreachable bytecodes. r=luke

---
 js/src/jsopcode.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index ceb86e3b9af1..742de401aa8f 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -778,7 +778,7 @@ js_DisassembleAtPC(JSContext *cx, JSScript *scriptArg, bool lines,
             if (parser.isReachable(next))
                 Sprint(sp, "%05u ", parser.stackDepthAtPC(next));
             else
-                Sprint(sp, "      ", parser.stackDepthAtPC(next));
+                Sprint(sp, "      ");
         }
         len = js_Disassemble1(cx, script, next, script->pcToOffset(next), lines, sp);
         if (!len)

From 7da22095a00fbb332ab4a32fda12444731aea698 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:42:08 +0100
Subject: [PATCH 076/144] Bug 927782 - Part 10: Iterate block chain from
 compile-time block scope maps, not runtime blockChain. r=luke

---
 js/jsd/jsd_stak.cpp             |   2 +-
 js/public/OldDebugAPI.h         |   6 +-
 js/src/jit/BaselineCompiler.cpp |  14 +-
 js/src/jit/IonFrames.cpp        |  10 +-
 js/src/jit/VMFunctions.cpp      |  24 +--
 js/src/jit/VMFunctions.h        |   6 +-
 js/src/jsobj.cpp                |   3 +-
 js/src/jsopcode.cpp             |  27 ++-
 js/src/shell/js.cpp             |   4 +-
 js/src/vm/Debugger.cpp          |   8 +-
 js/src/vm/Interpreter.cpp       | 284 ++++++++++++++++++--------------
 js/src/vm/Interpreter.h         |   8 +-
 js/src/vm/OldDebugAPI.cpp       |  38 +++--
 js/src/vm/ScopeObject.cpp       | 140 ++++++++++------
 js/src/vm/ScopeObject.h         |  59 +++++--
 js/src/vm/Stack.h               |   3 -
 16 files changed, 374 insertions(+), 262 deletions(-)

diff --git a/js/jsd/jsd_stak.cpp b/js/jsd/jsd_stak.cpp
index b5f7e0efd62f..2ee69e9e4aaf 100644
--- a/js/jsd/jsd_stak.cpp
+++ b/js/jsd/jsd_stak.cpp
@@ -97,7 +97,7 @@ jsd_NewThreadState(JSDContext* jsdc, JSContext *cx )
     {
         JSAbstractFramePtr frame = iter.abstractFramePtr();
         JS::RootedScript script(cx, frame.script());
-        uintptr_t  pc = (uintptr_t)iter.pc();
+        uintptr_t  pc = (uintptr_t)frame.pc();
         JS::RootedValue dummyThis(cx);
 
         /*
diff --git a/js/public/OldDebugAPI.h b/js/public/OldDebugAPI.h
index 1b66350d46b8..1dfbc2f1a499 100644
--- a/js/public/OldDebugAPI.h
+++ b/js/public/OldDebugAPI.h
@@ -339,16 +339,18 @@ JS_PutPropertyDescArray(JSContext *cx, JSPropertyDescArray *pda);
 class JS_PUBLIC_API(JSAbstractFramePtr)
 {
     uintptr_t ptr_;
+    jsbytecode *pc_;
 
   protected:
     JSAbstractFramePtr()
-      : ptr_(0)
+      : ptr_(0), pc_(nullptr)
     { }
 
   public:
-    explicit JSAbstractFramePtr(void *raw);
+    JSAbstractFramePtr(void *raw, jsbytecode *pc);
 
     uintptr_t raw() const { return ptr_; }
+    jsbytecode *pc() const { return pc_; }
 
     operator bool() const { return !!ptr_; }
 
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index b9309fcc67a9..60592925193a 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -508,7 +508,7 @@ BaselineCompiler::emitStackCheck(bool earlyCheck)
     return true;
 }
 
-typedef bool (*DebugPrologueFn)(JSContext *, BaselineFrame *, bool *);
+typedef bool (*DebugPrologueFn)(JSContext *, BaselineFrame *, jsbytecode *, bool *);
 static const VMFunction DebugPrologueInfo = FunctionInfo<DebugPrologueFn>(jit::DebugPrologue);
 
 bool
@@ -521,6 +521,7 @@ BaselineCompiler::emitDebugPrologue()
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
 
     prepareVMCall();
+    pushArg(ImmPtr(pc));
     pushArg(R0.scratchReg());
     if (!callVM(DebugPrologueInfo))
         return false;
@@ -2625,16 +2626,18 @@ BaselineCompiler::emit_JSOP_ENTERLET2()
     return emitEnterBlock();
 }
 
-typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *);
+typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *, jsbytecode *);
 static const VMFunction DebugLeaveBlockInfo = FunctionInfo<DebugLeaveBlockFn>(jit::DebugLeaveBlock);
 
 bool
 BaselineCompiler::emit_JSOP_DEBUGLEAVEBLOCK()
 {
-    // Call a stub to pop the block from the block chain.
-    prepareVMCall();
+    if (!debugMode_)
+        return true;
 
+    prepareVMCall();
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(ImmPtr(pc));
     pushArg(R0.scratchReg());
 
     return callVM(DebugLeaveBlockInfo);
@@ -2733,7 +2736,7 @@ BaselineCompiler::emit_JSOP_DEBUGGER()
     return true;
 }
 
-typedef bool (*DebugEpilogueFn)(JSContext *, BaselineFrame *, bool);
+typedef bool (*DebugEpilogueFn)(JSContext *, BaselineFrame *, jsbytecode *, bool);
 static const VMFunction DebugEpilogueInfo = FunctionInfo<DebugEpilogueFn>(jit::DebugEpilogue);
 
 bool
@@ -2750,6 +2753,7 @@ BaselineCompiler::emitReturn()
 
         prepareVMCall();
         pushArg(Imm32(1));
+        pushArg(ImmPtr(pc));
         pushArg(R0.scratchReg());
         if (!callVM(DebugEpilogueInfo))
             return false;
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index cecde0dee5cc..8703f31e8ea9 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -434,7 +434,7 @@ HandleExceptionBaseline(JSContext *cx, const IonFrameIterator &frame, ResumeFrom
 
           case JSTRAP_RETURN:
             JS_ASSERT(baselineFrame->hasReturnValue());
-            if (jit::DebugEpilogue(cx, baselineFrame, true)) {
+            if (jit::DebugEpilogue(cx, baselineFrame, pc, true)) {
                 rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
                 rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
                 rfe->stackPointer = reinterpret_cast<uint8_t *>(baselineFrame);
@@ -457,6 +457,7 @@ HandleExceptionBaseline(JSContext *cx, const IonFrameIterator &frame, ResumeFrom
     JSTryNote *tnEnd = tn + script->trynotes()->length;
 
     uint32_t pcOffset = uint32_t(pc - script->main());
+    ScopeIter si(frame.baselineFrame(), pc, cx);
     for (; tn != tnEnd; ++tn) {
         if (pcOffset < tn->start)
             continue;
@@ -472,7 +473,7 @@ HandleExceptionBaseline(JSContext *cx, const IonFrameIterator &frame, ResumeFrom
 
         // Unwind scope chain (pop block objects).
         if (cx->isExceptionPending())
-            UnwindScope(cx, frame.baselineFrame(), tn->stackDepth);
+            UnwindScope(cx, si, tn->stackDepth);
 
         // Compute base pointer and stack pointer.
         rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
@@ -607,7 +608,10 @@ HandleException(ResumeFromException *rfe)
                 // If DebugEpilogue returns |true|, we have to perform a forced
                 // return, e.g. return frame->returnValue() to the caller.
                 BaselineFrame *frame = iter.baselineFrame();
-                if (jit::DebugEpilogue(cx, frame, false)) {
+                RootedScript script(cx);
+                jsbytecode *pc;
+                iter.baselineScriptAndPc(script.address(), &pc);
+                if (jit::DebugEpilogue(cx, frame, pc, false)) {
                     JS_ASSERT(frame->hasReturnValue());
                     rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
                     rfe->framePointer = iter.fp() - BaselineFrame::FramePointerOffset;
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 04fd28a4a003..da14ed83316c 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -679,11 +679,11 @@ GetIndexFromString(JSString *str)
 }
 
 bool
-DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn)
+DebugPrologue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn)
 {
     *mustReturn = false;
 
-    JSTrapStatus status = ScriptDebugPrologue(cx, frame);
+    JSTrapStatus status = ScriptDebugPrologue(cx, frame, pc);
     switch (status) {
       case JSTRAP_CONTINUE:
         return true;
@@ -693,7 +693,7 @@ DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn)
         // debug epilogue handler as well.
         JS_ASSERT(frame->hasReturnValue());
         *mustReturn = true;
-        return jit::DebugEpilogue(cx, frame, true);
+        return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
       case JSTRAP_ERROR:
@@ -705,15 +705,16 @@ DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn)
 }
 
 bool
-DebugEpilogue(JSContext *cx, BaselineFrame *frame, bool ok)
+DebugEpilogue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool ok)
 {
     // Unwind scope chain to stack depth 0.
-    UnwindScope(cx, frame, 0);
+    ScopeIter si(frame, pc, cx);
+    UnwindScope(cx, si, 0);
 
     // If ScriptDebugEpilogue returns |true| we have to return the frame's
     // return value. If it returns |false|, the debugger threw an exception.
     // In both cases we have to pop debug scopes.
-    ok = ScriptDebugEpilogue(cx, frame, ok);
+    ok = ScriptDebugEpilogue(cx, frame, pc, ok);
 
     if (frame->isNonEvalFunctionFrame()) {
         JS_ASSERT_IF(ok, frame->hasReturnValue());
@@ -832,7 +833,7 @@ HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, bool *mus
       case JSTRAP_RETURN:
         *mustReturn = true;
         frame->setReturnValue(rval);
-        return jit::DebugEpilogue(cx, frame, true);
+        return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
         cx->setPendingException(rval);
@@ -870,7 +871,7 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
       case JSTRAP_RETURN:
         frame->setReturnValue(rval);
         *mustReturn = true;
-        return jit::DebugEpilogue(cx, frame, true);
+        return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
         cx->setPendingException(rval);
@@ -895,12 +896,11 @@ LeaveBlock(JSContext *cx, BaselineFrame *frame)
 }
 
 bool
-DebugLeaveBlock(JSContext *cx, BaselineFrame *frame)
+DebugLeaveBlock(JSContext *cx, BaselineFrame *frame, jsbytecode *pc)
 {
-    JS_ASSERT(frame->hasBlockChain());
+    JS_ASSERT(cx->compartment()->debugMode());
 
-    if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onPopBlock(cx, frame);
+    DebugScopes::onPopBlock(cx, frame, pc);
 
     return true;
 }
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index a29ae2b6fbf4..037b76a5042a 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -638,8 +638,8 @@ void PostGlobalWriteBarrier(JSRuntime *rt, JSObject *obj);
 
 uint32_t GetIndexFromString(JSString *str);
 
-bool DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn);
-bool DebugEpilogue(JSContext *cx, BaselineFrame *frame, bool ok);
+bool DebugPrologue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn);
+bool DebugEpilogue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool ok);
 
 bool StrictEvalPrologue(JSContext *cx, BaselineFrame *frame);
 bool HeavyweightFunPrologue(JSContext *cx, BaselineFrame *frame);
@@ -654,7 +654,7 @@ bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bo
 
 bool EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
 bool LeaveBlock(JSContext *cx, BaselineFrame *frame);
-bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame);
+bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame, jsbytecode *pc);
 
 bool InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame,
                              uint32_t numStackValues);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f909f8ece251..b362833bff1a 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5673,9 +5673,8 @@ js_DumpStackFrame(JSContext *cx, StackFrame *start)
         if (jsbytecode *pc = i.pc()) {
             fprintf(stderr, "  pc = %p\n", pc);
             fprintf(stderr, "  current op: %s\n", js_CodeName[*pc]);
+            MaybeDumpObject("blockChain", i.script()->getBlockScope(pc));
         }
-        if (!i.isJit())
-            MaybeDumpObject("blockChain", i.interpFrame()->maybeBlockChain());
         MaybeDumpValue("this", i.thisv());
         if (!i.isJit()) {
             fprintf(stderr, "  rval: ");
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 742de401aa8f..cb8d3f25f27d 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -1688,24 +1688,17 @@ ExpressionDecompiler::loadAtom(jsbytecode *pc)
 JSAtom *
 ExpressionDecompiler::findLetVar(jsbytecode *pc, unsigned depth)
 {
-    if (script->hasObjects()) {
-        JSObject *chain = script->getBlockScope(pc);
-        if (!chain)
-            return nullptr;
-        JS_ASSERT(chain->is<BlockObject>());
-        do {
-            BlockObject &block = chain->as<BlockObject>();
-            uint32_t blockDepth = block.stackDepth();
-            uint32_t blockCount = block.slotCount();
-            if (uint32_t(depth - blockDepth) < uint32_t(blockCount)) {
-                for (Shape::Range<NoGC> r(block.lastProperty()); !r.empty(); r.popFront()) {
-                    const Shape &shape = r.front();
-                    if (shape.shortid() == int(depth - blockDepth))
-                        return JSID_TO_ATOM(shape.propid());
-                }
+    for (JSObject *chain = script->getBlockScope(pc); chain; chain = chain->getParent()) {
+        StaticBlockObject &block = chain->as<StaticBlockObject>();
+        uint32_t blockDepth = block.stackDepth();
+        uint32_t blockCount = block.slotCount();
+        if (uint32_t(depth - blockDepth) < uint32_t(blockCount)) {
+            for (Shape::Range<NoGC> r(block.lastProperty()); !r.empty(); r.popFront()) {
+                const Shape &shape = r.front();
+                if (shape.shortid() == int(depth - blockDepth))
+                    return JSID_TO_ATOM(shape.propid());
             }
-            chain = chain->getParent();
-        } while (chain && chain->is<BlockObject>());
+        }
     }
     return nullptr;
 }
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 594de924ed93..2d526784902c 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1512,7 +1512,7 @@ TrapHandler(JSContext *cx, JSScript *, jsbytecode *pc, jsval *rvalArg,
     JS_ASSERT(!iter.done());
 
     /* Debug-mode currently disables Ion compilation. */
-    JSAbstractFramePtr frame(Jsvalify(iter.abstractFramePtr()));
+    JSAbstractFramePtr frame(iter.abstractFramePtr().raw(), iter.pc());
     RootedScript script(cx, iter.script());
 
     size_t length;
@@ -2590,7 +2590,7 @@ EvalInFrame(JSContext *cx, unsigned argc, jsval *vp)
     if (!chars)
         return false;
 
-    JSAbstractFramePtr frame(Jsvalify(fi.abstractFramePtr()));
+    JSAbstractFramePtr frame(fi.abstractFramePtr().raw(), fi.pc());
     RootedScript fpscript(cx, frame.script());
     bool ok = !!frame.evaluateUCInStackFrame(cx, chars, length,
                                              fpscript->filename(),
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 3ee25d6bc1e5..a188f2d5c382 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -3988,12 +3988,12 @@ DebuggerFrame_getType(JSContext *cx, unsigned argc, Value *vp)
 static bool
 DebuggerFrame_getEnvironment(JSContext *cx, unsigned argc, Value *vp)
 {
-    THIS_FRAME_OWNER(cx, argc, vp, "get environment", args, thisobj, frame, dbg);
+    THIS_FRAME_OWNER_ITER(cx, argc, vp, "get environment", args, thisobj, _, iter, dbg);
 
     Rooted<Env*> env(cx);
     {
-        AutoCompartment ac(cx, frame.scopeChain());
-        env = GetDebugScopeForFrame(cx, frame);
+        AutoCompartment ac(cx, iter.abstractFramePtr().scopeChain());
+        env = GetDebugScopeForFrame(cx, iter.abstractFramePtr(), iter.pc());
         if (!env)
             return false;
     }
@@ -4439,7 +4439,7 @@ DebuggerGenericEval(JSContext *cx, const char *fullMethodName, const Value &code
         if (!iter->computeThis(cx))
             return false;
         thisv = iter->thisv();
-        env = GetDebugScopeForFrame(cx, iter->abstractFramePtr());
+        env = GetDebugScopeForFrame(cx, iter->abstractFramePtr(), iter->pc());
         if (!env)
             return false;
     } else {
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 0ea4658a9817..d25eda18bfa1 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -845,24 +845,22 @@ EnterWith(JSContext *cx, AbstractFramePtr frame, HandleValue val, uint32_t stack
 
 /* Unwind block and scope chains to match the given depth. */
 void
-js::UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth)
+js::UnwindScope(JSContext *cx, ScopeIter &si, uint32_t stackDepth)
 {
-    JS_ASSERT_IF(frame.isStackFrame(), frame.asStackFrame() == cx->interpreterFrame());
-    JS_ASSERT_IF(frame.isStackFrame(), stackDepth <= cx->interpreterRegs().stackDepth());
-
-    for (ScopeIter si(frame, cx); !si.done(); ++si) {
+    for (; !si.done(); ++si) {
         switch (si.type()) {
           case ScopeIter::Block:
             if (si.staticBlock().stackDepth() < stackDepth)
                 return;
             if (cx->compartment()->debugMode())
-                DebugScopes::onPopBlock(cx, frame);
-            frame.popBlock(cx);
+                DebugScopes::onPopBlock(cx, si);
+            JS_ASSERT(&si.staticBlock() == si.frame().maybeBlockChain());
+            si.frame().popBlock(cx);
             break;
           case ScopeIter::With:
             if (si.scope().as<WithObject>().stackDepth() < stackDepth)
                 return;
-            frame.popWith(cx);
+            si.frame().popWith(cx);
             break;
           case ScopeIter::Call:
           case ScopeIter::StrictEvalScope:
@@ -871,10 +869,24 @@ js::UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth)
     }
 }
 
+static void
+ForcedReturn(JSContext *cx, ScopeIter &si, FrameRegs &regs)
+{
+    UnwindScope(cx, si, 0);
+    regs.setToEndOfScript();
+}
+
+static void
+ForcedReturn(JSContext *cx, FrameRegs &regs)
+{
+    ScopeIter si(regs.fp(), regs.pc, cx);
+    ForcedReturn(cx, si, regs);
+}
+
 void
 js::UnwindForUncatchableException(JSContext *cx, const FrameRegs &regs)
 {
-    /* c.f. the regular (catchable) TryNoteIter loop in Interpret. */
+    /* c.f. the regular (catchable) TryNoteIter loop in HandleError. */
     for (TryNoteIter tni(cx, regs); !tni.done(); ++tni) {
         JSTryNote *tn = *tni;
         if (tn->kind == JSTRY_ITER) {
@@ -943,6 +955,107 @@ TryNoteIter::settle()
     }
 }
 
+enum HandleErrorContinuation
+{
+    SuccessfulReturnContinuation,
+    ErrorReturnContinuation,
+    CatchContinuation,
+    FinallyContinuation
+};
+
+static HandleErrorContinuation
+HandleError(JSContext *cx, FrameRegs &regs)
+{
+    JS_ASSERT(regs.fp()->script()->containsPC(regs.pc));
+
+    ScopeIter si(regs.fp(), regs.pc, cx);
+    bool ok = false;
+
+  again:
+    if (cx->isExceptionPending()) {
+        /* Call debugger throw hooks. */
+        if (JS_UNLIKELY(cx->compartment()->debugMode())) {
+            JSTrapStatus status = DebugExceptionUnwind(cx, regs.fp(), regs.pc);
+            switch (status) {
+              case JSTRAP_ERROR:
+                goto again;
+
+              case JSTRAP_CONTINUE:
+              case JSTRAP_THROW:
+                break;
+
+              case JSTRAP_RETURN:
+                ForcedReturn(cx, si, regs);
+                return SuccessfulReturnContinuation;
+
+              default:
+                MOZ_ASSUME_UNREACHABLE("Invalid trap status");
+            }
+        }
+
+        for (TryNoteIter tni(cx, regs); !tni.done(); ++tni) {
+            JSTryNote *tn = *tni;
+
+            UnwindScope(cx, si, tn->stackDepth);
+
+            /*
+             * Set pc to the first bytecode after the the try note to point
+             * to the beginning of catch or finally or to [enditer] closing
+             * the for-in loop.
+             */
+            regs.pc = regs.fp()->script()->main() + tn->start + tn->length;
+            regs.sp = regs.spForStackDepth(tn->stackDepth);
+
+            switch (tn->kind) {
+              case JSTRY_CATCH:
+                /* Catch cannot intercept the closing of a generator. */
+                if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
+                    break;
+
+                /*
+                 * Don't clear exceptions to save cx->exception from GC
+                 * until it is pushed to the stack via [exception] in the
+                 * catch block.
+                 */
+                return CatchContinuation;
+
+              case JSTRY_FINALLY:
+                return FinallyContinuation;
+
+              case JSTRY_ITER: {
+                /* This is similar to JSOP_ENDITER in the interpreter loop. */
+                JS_ASSERT(JSOp(*regs.pc) == JSOP_ENDITER);
+                RootedObject obj(cx, &regs.sp[-1].toObject());
+                bool ok = UnwindIteratorForException(cx, obj);
+                regs.sp -= 1;
+                if (!ok)
+                    goto again;
+                break;
+              }
+
+              case JSTRY_LOOP:
+                break;
+            }
+        }
+
+        /*
+         * Propagate the exception or error to the caller unless the exception
+         * is an asynchronous return from a generator.
+         */
+        if (JS_UNLIKELY(cx->isExceptionPending() &&
+                        cx->getPendingException().isMagic(JS_GENERATOR_CLOSING))) {
+            cx->clearPendingException();
+            ok = true;
+            regs.fp()->clearReturnValue();
+        }
+    } else {
+        UnwindForUncatchableException(cx, regs);
+    }
+
+    ForcedReturn(cx, si, regs);
+    return ok ? SuccessfulReturnContinuation : ErrorReturnContinuation;
+}
+
 #define REGS                     (activation.regs())
 #define PUSH_COPY(v)             do { *REGS.sp++ = (v); assertSameCompartmentDebugOnly(cx, REGS.sp[-1]); } while (0)
 #define PUSH_COPY_SKIP_CHECK(v)  *REGS.sp++ = (v)
@@ -1373,13 +1486,13 @@ Interpret(JSContext *cx, RunState &state)
         probes::EnterScript(cx, script, script->function(), activation.entryFrame());
     }
     if (JS_UNLIKELY(cx->compartment()->debugMode())) {
-        JSTrapStatus status = ScriptDebugPrologue(cx, activation.entryFrame());
+        JSTrapStatus status = ScriptDebugPrologue(cx, activation.entryFrame(), REGS.pc);
         switch (status) {
           case JSTRAP_CONTINUE:
             break;
           case JSTRAP_RETURN:
-            interpReturnOK = true;
-            goto forced_return;
+            ForcedReturn(cx, REGS);
+            goto successful_return_continuation;
           case JSTRAP_THROW:
           case JSTRAP_ERROR:
             goto error;
@@ -1391,7 +1504,6 @@ Interpret(JSContext *cx, RunState &state)
     if (cx->runtime()->profilingScripts || cx->runtime()->debugHooks.interruptHook)
         activation.enableInterruptsUnconditionally();
 
-  enterInterpreterLoop:
     // Enter the interpreter loop starting at the current pc.
     ADVANCE_AND_DISPATCH(0);
 
@@ -1431,8 +1543,8 @@ CASE(EnableInterruptsPseudoOpcode)
                 break;
               case JSTRAP_RETURN:
                 REGS.fp()->setReturnValue(rval);
-                interpReturnOK = true;
-                goto forced_return;
+                ForcedReturn(cx, REGS);
+                goto successful_return_continuation;
               case JSTRAP_THROW:
                 cx->setPendingException(rval);
                 goto error;
@@ -1452,8 +1564,8 @@ CASE(EnableInterruptsPseudoOpcode)
                 goto error;
               case JSTRAP_RETURN:
                 REGS.fp()->setReturnValue(rval);
-                interpReturnOK = true;
-                goto forced_return;
+                ForcedReturn(cx, REGS);
+                goto successful_return_continuation;
               case JSTRAP_THROW:
                 cx->setPendingException(rval);
                 goto error;
@@ -1650,7 +1762,9 @@ CASE(JSOP_RETRVAL)
      */
     CHECK_BRANCH();
 
+  successful_return_continuation:
     interpReturnOK = true;
+  return_continuation:
     if (activation.entryFrame() != REGS.fp())
   inline_return:
     {
@@ -1659,7 +1773,7 @@ CASE(JSOP_RETRVAL)
 #endif
 
         if (JS_UNLIKELY(cx->compartment()->debugMode()))
-            interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), interpReturnOK);
+            interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), REGS.pc, interpReturnOK);
 
         if (!REGS.fp()->isYielding())
             REGS.fp()->epilogue(cx);
@@ -1692,7 +1806,6 @@ CASE(JSOP_RETRVAL)
     } else {
         JS_ASSERT(REGS.stackDepth() == 0);
     }
-    interpReturnOK = true;
     goto exit;
 }
 
@@ -2568,12 +2681,12 @@ CASE(JSOP_FUNCALL)
     if (!REGS.fp()->prologue(cx))
         goto error;
     if (JS_UNLIKELY(cx->compartment()->debugMode())) {
-        switch (ScriptDebugPrologue(cx, REGS.fp())) {
+        switch (ScriptDebugPrologue(cx, REGS.fp(), REGS.pc)) {
           case JSTRAP_CONTINUE:
             break;
           case JSTRAP_RETURN:
-            interpReturnOK = true;
-            goto forced_return;
+            ForcedReturn(cx, REGS);
+            goto successful_return_continuation;
           case JSTRAP_THROW:
           case JSTRAP_ERROR:
             goto error;
@@ -3213,8 +3326,8 @@ CASE(JSOP_DEBUGGER)
         break;
       case JSTRAP_RETURN:
         REGS.fp()->setReturnValue(rval);
-        interpReturnOK = true;
-        goto forced_return;
+        ForcedReturn(cx, REGS);
+        goto successful_return_continuation;
       case JSTRAP_THROW:
         cx->setPendingException(rval);
         goto error;
@@ -3250,6 +3363,7 @@ CASE(JSOP_LEAVEBLOCKEXPR)
 {
     blockDepth = REGS.fp()->blockChain().stackDepth();
 
+    // Pop block from scope chain.
     REGS.fp()->popBlock(cx);
 
     if (*REGS.pc == JSOP_LEAVEBLOCK) {
@@ -3271,13 +3385,13 @@ END_CASE(JSOP_LEAVEBLOCK)
 
 CASE(JSOP_DEBUGLEAVEBLOCK)
 {
-    JS_ASSERT(REGS.fp()->hasBlockChain());
+    JS_ASSERT(script->getBlockScope(REGS.pc));
 
     // FIXME: This opcode should not be necessary.  The debugger shouldn't need
     // help from bytecode to do its job.  See bug 927782.
 
     if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onPopBlock(cx, REGS.fp());
+        DebugScopes::onPopBlock(cx, REGS.fp(), REGS.pc);
 }
 END_CASE(JSOP_DEBUGLEAVEBLOCK)
 
@@ -3339,116 +3453,32 @@ DEFAULT()
     MOZ_ASSUME_UNREACHABLE("Interpreter loop exited via fallthrough");
 
   error:
-    JS_ASSERT(script->containsPC(REGS.pc));
+    switch (HandleError(cx, REGS)) {
+      case SuccessfulReturnContinuation:
+        goto successful_return_continuation;
 
-    if (cx->isExceptionPending()) {
-        /* Call debugger throw hooks. */
-        if (JS_UNLIKELY(cx->compartment()->debugMode())) {
-            JSTrapStatus status = DebugExceptionUnwind(cx, REGS.fp(), REGS.pc);
-            switch (status) {
-              case JSTRAP_ERROR:
-                goto error;
+      case ErrorReturnContinuation:
+        interpReturnOK = false;
+        goto return_continuation;
 
-              case JSTRAP_CONTINUE:
-              case JSTRAP_THROW:
-                break;
-
-              case JSTRAP_RETURN:
-                interpReturnOK = true;
-                goto forced_return;
-
-              default:
-                MOZ_ASSUME_UNREACHABLE("Invalid trap status");
-            }
-        }
-
-        for (TryNoteIter tni(cx, REGS); !tni.done(); ++tni) {
-            JSTryNote *tn = *tni;
-
-            UnwindScope(cx, REGS.fp(), tn->stackDepth);
-
-            /*
-             * Set pc to the first bytecode after the the try note to point
-             * to the beginning of catch or finally or to [enditer] closing
-             * the for-in loop.
-             */
-            REGS.pc = (script)->main() + tn->start + tn->length;
-            REGS.sp = REGS.spForStackDepth(tn->stackDepth);
-
-            switch (tn->kind) {
-              case JSTRY_CATCH:
-                /* Catch cannot intercept the closing of a generator. */
-                if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
-                    break;
-
-                /*
-                 * Don't clear exceptions to save cx->exception from GC
-                 * until it is pushed to the stack via [exception] in the
-                 * catch block.
-                 *
-                 * Also, see the comment below about the use of goto here.
-                 */
-                goto enterInterpreterLoop;
-
-              case JSTRY_FINALLY:
-                /*
-                 * Push (true, exception) pair for finally to indicate that
-                 * [retsub] should rethrow the exception.
-                 */
-                PUSH_BOOLEAN(true);
-                PUSH_COPY(cx->getPendingException());
-                cx->clearPendingException();
-
-                /*
-                 * Leave the scope via a plain goto (and not via
-                 * ADVANCE_AND_DISPATCH, which may be implemented with indirect
-                 * goto) so that the TryNoteIter goes out of scope properly.
-                 */
-                goto enterInterpreterLoop;
-
-              case JSTRY_ITER: {
-                /* This is similar to JSOP_ENDITER in the interpreter loop. */
-                JS_ASSERT(JSOp(*REGS.pc) == JSOP_ENDITER);
-                RootedObject &obj = rootObject0;
-                obj = &REGS.sp[-1].toObject();
-                bool ok = UnwindIteratorForException(cx, obj);
-                REGS.sp -= 1;
-                if (!ok)
-                    goto error;
-                break;
-              }
-
-              case JSTRY_LOOP:
-                break;
-           }
-        }
+      case CatchContinuation:
+        ADVANCE_AND_DISPATCH(0);
 
+      case FinallyContinuation:
         /*
-         * Propagate the exception or error to the caller unless the exception
-         * is an asynchronous return from a generator.
+         * Push (true, exception) pair for finally to indicate that [retsub]
+         * should rethrow the exception.
          */
-        interpReturnOK = false;
-        if (JS_UNLIKELY(cx->isExceptionPending() &&
-                        cx->getPendingException().isMagic(JS_GENERATOR_CLOSING))) {
-            cx->clearPendingException();
-            interpReturnOK = true;
-            REGS.fp()->clearReturnValue();
-        }
-    } else {
-        UnwindForUncatchableException(cx, REGS);
-        interpReturnOK = false;
+        PUSH_BOOLEAN(true);
+        PUSH_COPY(cx->getPendingException());
+        cx->clearPendingException();
+        ADVANCE_AND_DISPATCH(0);
     }
-
-  forced_return:
-    UnwindScope(cx, REGS.fp(), 0);
-    REGS.setToEndOfScript();
-
-    if (activation.entryFrame() != REGS.fp())
-        goto inline_return;
+    MOZ_ASSUME_UNREACHABLE("Invalid HandleError continuation");
 
   exit:
     if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), interpReturnOK);
+        interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), REGS.pc, interpReturnOK);
     if (!REGS.fp()->isYielding())
         REGS.fp()->epilogue(cx);
     else
diff --git a/js/src/vm/Interpreter.h b/js/src/vm/Interpreter.h
index f884b41ed50f..4724413eee19 100644
--- a/js/src/vm/Interpreter.h
+++ b/js/src/vm/Interpreter.h
@@ -18,6 +18,8 @@
 
 namespace js {
 
+class ScopeIter;
+
 /*
  * Announce to the debugger that the thread has entered a new JavaScript frame,
  * |frame|. Call whatever hooks have been registered to observe new frames, and
@@ -36,7 +38,7 @@ namespace js {
  *   has set |frame|'s return value appropriately.
  */
 extern JSTrapStatus
-ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame);
+ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc);
 
 /*
  * Announce to the debugger that the thread has exited a JavaScript frame, |frame|.
@@ -54,7 +56,7 @@ ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame);
  * alternative path, containing its own call to ScriptDebugEpilogue.)
  */
 extern bool
-ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, bool ok);
+ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc, bool ok);
 
 /*
  * Announce to the debugger that an exception has been thrown and propagated
@@ -318,7 +320,7 @@ HasInstance(JSContext *cx, HandleObject obj, HandleValue v, bool *bp);
 
 /* Unwind block and scope chains to match the given depth. */
 extern void
-UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth);
+UnwindScope(JSContext *cx, ScopeIter &si, uint32_t stackDepth);
 
 /*
  * Unwind for an uncatchable exception. This means not running finalizers, etc;
diff --git a/js/src/vm/OldDebugAPI.cpp b/js/src/vm/OldDebugAPI.cpp
index 18cb5e83c8a5..e5648f95a7da 100644
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@@ -68,18 +68,19 @@ IsTopFrameConstructing(JSContext *cx, AbstractFramePtr frame)
 }
 
 JSTrapStatus
-js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame)
+js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     JS_ASSERT_IF(frame.isStackFrame(), frame.asStackFrame() == cx->interpreterFrame());
 
     if (!frame.script()->selfHosted()) {
+        JSAbstractFramePtr jsframe(frame.raw(), pc);
         if (frame.isFramePushedByExecute()) {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.executeHook)
-                frame.setHookData(hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame),
+                frame.setHookData(hook(cx, jsframe, IsTopFrameConstructing(cx, frame),
                                        true, 0, cx->runtime()->debugHooks.executeHookData));
         } else {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.callHook)
-                frame.setHookData(hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame),
+                frame.setHookData(hook(cx, jsframe, IsTopFrameConstructing(cx, frame),
                                        true, 0, cx->runtime()->debugHooks.callHookData));
         }
     }
@@ -105,7 +106,7 @@ js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame)
 }
 
 bool
-js::ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, bool okArg)
+js::ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc, bool okArg)
 {
     JS_ASSERT_IF(frame.isStackFrame(), frame.asStackFrame() == cx->interpreterFrame());
 
@@ -113,12 +114,13 @@ js::ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, bool okArg)
 
     // We don't add hook data for self-hosted scripts, so we don't need to check for them, here.
     if (void *hookData = frame.maybeHookData()) {
+        JSAbstractFramePtr jsframe(frame.raw(), pc);
         if (frame.isFramePushedByExecute()) {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.executeHook)
-                hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame), false, &ok, hookData);
+                hook(cx, jsframe, IsTopFrameConstructing(cx, frame), false, &ok, hookData);
         } else {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.callHook)
-                hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame), false, &ok, hookData);
+                hook(cx, jsframe, IsTopFrameConstructing(cx, frame), false, &ok, hookData);
         }
     }
 
@@ -1228,27 +1230,27 @@ JS::FormatStackDump(JSContext *cx, char *buf, bool showArgs, bool showLocals, bo
     return buf;
 }
 
-JSAbstractFramePtr::JSAbstractFramePtr(void *raw)
-  : ptr_(uintptr_t(raw))
+JSAbstractFramePtr::JSAbstractFramePtr(void *raw, jsbytecode *pc)
+  : ptr_(uintptr_t(raw)), pc_(pc)
 { }
 
 JSObject *
 JSAbstractFramePtr::scopeChain(JSContext *cx)
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     RootedObject scopeChain(cx, frame.scopeChain());
     AutoCompartment ac(cx, scopeChain);
-    return GetDebugScopeForFrame(cx, frame);
+    return GetDebugScopeForFrame(cx, frame, pc());
 }
 
 JSObject *
 JSAbstractFramePtr::callObject(JSContext *cx)
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     if (!frame.isFunctionFrame())
         return nullptr;
 
-    JSObject *o = GetDebugScopeForFrame(cx, frame);
+    JSObject *o = GetDebugScopeForFrame(cx, frame, pc());
 
     /*
      * Given that fp is a function frame and GetDebugScopeForFrame always fills
@@ -1270,21 +1272,21 @@ JSAbstractFramePtr::callObject(JSContext *cx)
 JSFunction *
 JSAbstractFramePtr::maybeFun()
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     return frame.maybeFun();
 }
 
 JSScript *
 JSAbstractFramePtr::script()
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     return frame.script();
 }
 
 bool
 JSAbstractFramePtr::getThisValue(JSContext *cx, MutableHandleValue thisv)
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
 
     RootedObject scopeChain(cx, frame.scopeChain());
     js::AutoCompartment ac(cx, scopeChain);
@@ -1298,7 +1300,7 @@ JSAbstractFramePtr::getThisValue(JSContext *cx, MutableHandleValue thisv)
 bool
 JSAbstractFramePtr::isDebuggerFrame()
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     return frame.isDebuggerFrame();
 }
 
@@ -1340,7 +1342,7 @@ JSAbstractFramePtr::evaluateUCInStackFrame(JSContext *cx,
     if (!env)
         return false;
 
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     if (!ComputeThis(cx, frame))
         return false;
     RootedValue thisv(cx, frame.thisValue());
@@ -1382,7 +1384,7 @@ JSAbstractFramePtr
 JSBrokenFrameIterator::abstractFramePtr() const
 {
     NonBuiltinScriptFrameIter iter(*(ScriptFrameIter::Data *)data_);
-    return Jsvalify(iter.abstractFramePtr());
+    return JSAbstractFramePtr(iter.abstractFramePtr().raw(), iter.pc());
 }
 
 jsbytecode *
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index ae8ea9799178..5e61bf7f5675 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -874,19 +874,32 @@ ScopeIter::ScopeIter(JSObject &enclosingScope, JSContext *cx
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 }
 
-ScopeIter::ScopeIter(AbstractFramePtr frame, JSContext *cx
+ScopeIter::ScopeIter(AbstractFramePtr frame, jsbytecode *pc, JSContext *cx
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : cx(cx),
     frame_(frame),
     cur_(cx, frame.scopeChain()),
-    block_(cx, frame.maybeBlockChain())
+    block_(cx, frame.script()->getBlockScope(pc))
 {
     assertSameCompartment(cx, frame);
     settle();
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 }
 
-ScopeIter::ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
+ScopeIter::ScopeIter(const ScopeIterVal &val, JSContext *cx
+                     MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
+  : cx(cx),
+    frame_(val.frame_),
+    cur_(cx, val.cur_),
+    block_(cx, val.block_),
+    type_(val.type_),
+    hasScopeObject_(val.hasScopeObject_)
+{
+    assertSameCompartment(cx, val.frame_);
+    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+}
+
+ScopeIter::ScopeIter(AbstractFramePtr frame, jsbytecode *pc, ScopeObject &scope, JSContext *cx
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : cx(cx),
     frame_(frame),
@@ -903,13 +916,13 @@ ScopeIter::ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
      *     let (y = 1) g();
      *   }
      *
-     * g will have x's block in its enclosing scope but not y's. However, at
-     * the debugger statement, both the x's and y's blocks will be on
-     * fp->blockChain. Fortunately, we can compare scope object stack depths to
-     * determine the block (if any) that encloses 'scope'.
+     * g will have x's block in its enclosing scope but not y's. However, at the
+     * debugger statement, both the x's and y's blocks will be on the block
+     * chain. Fortunately, we can compare scope object stack depths to determine
+     * the block (if any) that encloses 'scope'.
      */
     if (cur_->is<NestedScopeObject>()) {
-        block_ = frame.maybeBlockChain();
+        block_ = frame.script()->getBlockScope(pc);
         while (block_) {
             if (block_->stackDepth() <= cur_->as<NestedScopeObject>().stackDepth())
                 break;
@@ -1052,6 +1065,20 @@ ScopeIterKey::match(ScopeIterKey si1, ScopeIterKey si2)
              si1.type_  == si2.type_));
 }
 
+// Live ScopeIter values may be added to DebugScopes::liveScopes, as
+// ScopeIterVal instances.  They need to have write barriers when they are added
+// to the hash table, but no barriers when rehashing inside GC.  It's a nasty
+// hack, but the important thing is that ScopeIterKey and ScopeIterVal need to
+// alias each other.
+void ScopeIterVal::staticAsserts() {
+    static_assert(sizeof(ScopeIterVal) == sizeof(ScopeIterKey),
+                  "ScopeIterVal must be same size of ScopeIterKey");
+    static_assert(offsetof(ScopeIterVal, cur_) == offsetof(ScopeIterKey, cur_),
+                  "ScopeIterVal.cur_ must alias ScopeIterKey.cur_");
+    static_assert(offsetof(ScopeIterVal, block_) == offsetof(ScopeIterKey, block_),
+                  "ScopeIterVal.block_ must alias ScopeIterKey.block_");
+}
+
 /*****************************************************************************/
 
 namespace {
@@ -1104,7 +1131,7 @@ class DebugScopeProxy : public BaseProxyHandler
                                jsid id, Action action, MutableHandleValue vp)
     {
         JS_ASSERT(&debugScope->scope() == scope);
-        AbstractFramePtr maybeframe = DebugScopes::hasLiveFrame(*scope);
+        ScopeIterVal *maybeLiveScope = DebugScopes::hasLiveScope(*scope);
 
         /* Handle unaliased formals, vars, and consts at function scope. */
         if (scope->is<CallObject>() && !scope->as<CallObject>().isForEval()) {
@@ -1125,11 +1152,12 @@ class DebugScopeProxy : public BaseProxyHandler
                 if (script->varIsAliased(i))
                     return false;
 
-                if (maybeframe) {
+                if (maybeLiveScope) {
+                    AbstractFramePtr frame = maybeLiveScope->frame();
                     if (action == GET)
-                        vp.set(maybeframe.unaliasedVar(i));
+                        vp.set(frame.unaliasedVar(i));
                     else
-                        maybeframe.unaliasedVar(i) = vp;
+                        frame.unaliasedVar(i) = vp;
                 } else if (JSObject *snapshot = debugScope->maybeSnapshot()) {
                     if (action == GET)
                         vp.set(snapshot->getDenseElement(bindings.numArgs() + i));
@@ -1146,17 +1174,18 @@ class DebugScopeProxy : public BaseProxyHandler
                 if (script->formalIsAliased(i))
                     return false;
 
-                if (maybeframe) {
-                    if (script->argsObjAliasesFormals() && maybeframe.hasArgsObj()) {
+                if (maybeLiveScope) {
+                    AbstractFramePtr frame = maybeLiveScope->frame();
+                    if (script->argsObjAliasesFormals() && frame.hasArgsObj()) {
                         if (action == GET)
-                            vp.set(maybeframe.argsObj().arg(i));
+                            vp.set(frame.argsObj().arg(i));
                         else
-                            maybeframe.argsObj().setArg(i, vp);
+                            frame.argsObj().setArg(i, vp);
                     } else {
                         if (action == GET)
-                            vp.set(maybeframe.unaliasedFormal(i, DONT_CHECK_ALIASING));
+                            vp.set(frame.unaliasedFormal(i, DONT_CHECK_ALIASING));
                         else
-                            maybeframe.unaliasedFormal(i, DONT_CHECK_ALIASING) = vp;
+                            frame.unaliasedFormal(i, DONT_CHECK_ALIASING) = vp;
                     }
                 } else if (JSObject *snapshot = debugScope->maybeSnapshot()) {
                     if (action == GET)
@@ -1187,13 +1216,14 @@ class DebugScopeProxy : public BaseProxyHandler
             if (block->staticBlock().isAliased(i))
                 return false;
 
-            if (maybeframe) {
-                JSScript *script = maybeframe.script();
+            if (maybeLiveScope) {
+                AbstractFramePtr frame = maybeLiveScope->frame();
+                JSScript *script = frame.script();
                 unsigned local = block->slotToLocalIndex(script->bindings, shape->slot());
                 if (action == GET)
-                    vp.set(maybeframe.unaliasedLocal(local));
+                    vp.set(frame.unaliasedLocal(local));
                 else
-                    maybeframe.unaliasedLocal(local) = vp;
+                    frame.unaliasedLocal(local) = vp;
                 JS_ASSERT(analyze::LocalSlot(script, local) >= analyze::TotalSlots(script));
             } else {
                 if (action == GET)
@@ -1250,14 +1280,14 @@ class DebugScopeProxy : public BaseProxyHandler
         if (scope.as<CallObject>().callee().nonLazyScript()->needsArgsObj())
             return true;
 
-        AbstractFramePtr maybeframe = DebugScopes::hasLiveFrame(scope);
-        if (!maybeframe) {
+        ScopeIterVal *maybeScope = DebugScopes::hasLiveScope(scope);
+        if (!maybeScope) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_DEBUG_NOT_LIVE,
                                  "Debugger scope");
             return false;
         }
 
-        *maybeArgsObj = ArgumentsObject::createUnexpected(cx, maybeframe);
+        *maybeArgsObj = ArgumentsObject::createUnexpected(cx, maybeScope->frame());
         return true;
     }
 
@@ -1544,8 +1574,15 @@ DebugScopes::proxiedScopesPostWriteBarrier(JSRuntime *rt, ObjectWeakMap *map,
 DebugScopes::liveScopesPostWriteBarrier(JSRuntime *rt, LiveScopeMap *map, ScopeObject *key)
 {
 #ifdef JSGC_GENERATIONAL
+    // As above.  Otherwise, barriers could fire during GC when moving the
+    // value.
+    typedef HashMap<ScopeObject *,
+                    ScopeIterKey,
+                    DefaultHasher<ScopeObject *>,
+                    RuntimeAllocPolicy> UnbarrieredLiveScopeMap;
+    typedef gc::HashKeyRef<UnbarrieredLiveScopeMap, ScopeObject *> Ref;
     if (key && IsInsideNursery(rt, key))
-        rt->gcStoreBuffer.putGeneric(gc::HashKeyRef<LiveScopeMap, ScopeObject *>(map, key));
+        rt->gcStoreBuffer.putGeneric(Ref(reinterpret_cast<UnbarrieredLiveScopeMap *>(map), key));
 #endif
 }
 
@@ -1728,7 +1765,7 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
     }
 
     JS_ASSERT(!scopes->liveScopes.has(&debugScope.scope()));
-    if (!scopes->liveScopes.put(&debugScope.scope(), si.frame())) {
+    if (!scopes->liveScopes.put(&debugScope.scope(), si)) {
         js_ReportOutOfMemory(cx);
         return false;
     }
@@ -1762,7 +1799,7 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext *cx)
         if (ObjectWeakMap::Ptr p = scopes->proxiedScopes.lookup(&callobj))
             debugScope = &p->value()->as<DebugScopeObject>();
     } else {
-        ScopeIter si(frame, cx);
+        ScopeIter si(frame, frame.script()->main(), cx);
         if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
             debugScope = p->value();
             scopes->liveScopes.remove(&debugScope->scope().as<CallObject>());
@@ -1817,7 +1854,7 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext *cx)
 }
 
 void
-DebugScopes::onPopBlock(JSContext *cx, AbstractFramePtr frame)
+DebugScopes::onPopBlock(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     assertSameCompartment(cx, frame);
 
@@ -1825,16 +1862,27 @@ DebugScopes::onPopBlock(JSContext *cx, AbstractFramePtr frame)
     if (!scopes)
         return;
 
-    StaticBlockObject &staticBlock = *frame.maybeBlockChain();
-    if (staticBlock.needsClone()) {
-        ClonedBlockObject &clone = frame.scopeChain()->as<ClonedBlockObject>();
-        clone.copyUnaliasedValues(frame);
+    ScopeIter si(frame, pc, cx);
+    onPopBlock(cx, si);
+}
+
+void
+DebugScopes::onPopBlock(JSContext *cx, const ScopeIter &si)
+{
+    DebugScopes *scopes = cx->compartment()->debugScopes;
+    if (!scopes)
+        return;
+
+    JS_ASSERT(si.type() == ScopeIter::Block);
+
+    if (si.staticBlock().needsClone()) {
+        ClonedBlockObject &clone = si.scope().as<ClonedBlockObject>();
+        clone.copyUnaliasedValues(si.frame());
         scopes->liveScopes.remove(&clone);
     } else {
-        ScopeIter si(frame, cx);
         if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
             ClonedBlockObject &clone = p->value()->scope().as<ClonedBlockObject>();
-            clone.copyUnaliasedValues(frame);
+            clone.copyUnaliasedValues(si.frame());
             scopes->liveScopes.remove(&clone);
             scopes->missingScopes.remove(p);
         }
@@ -1906,13 +1954,13 @@ DebugScopes::updateLiveScopes(JSContext *cx)
         if (frame.isFunctionFrame() && frame.callee()->isGenerator())
             continue;
 
-        for (ScopeIter si(frame, cx); !si.done(); ++si) {
+        for (ScopeIter si(frame, i.pc(), cx); !si.done(); ++si) {
             if (si.hasScopeObject()) {
                 JS_ASSERT(si.scope().compartment() == cx->compartment());
                 DebugScopes *scopes = ensureCompartmentData(cx);
                 if (!scopes)
                     return false;
-                if (!scopes->liveScopes.put(&si.scope(), frame))
+                if (!scopes->liveScopes.put(&si.scope(), si))
                     return false;
                 liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &si.scope());
             }
@@ -1927,17 +1975,17 @@ DebugScopes::updateLiveScopes(JSContext *cx)
     return true;
 }
 
-AbstractFramePtr
-DebugScopes::hasLiveFrame(ScopeObject &scope)
+ScopeIterVal*
+DebugScopes::hasLiveScope(ScopeObject &scope)
 {
     DebugScopes *scopes = scope.compartment()->debugScopes;
     if (!scopes)
-        return NullFramePtr();
+        return nullptr;
 
     if (LiveScopeMap::Ptr p = scopes->liveScopes.lookup(&scope))
-        return p->value();
+        return &p->value();
 
-    return NullFramePtr();
+    return nullptr;
 }
 
 /*****************************************************************************/
@@ -2058,8 +2106,8 @@ GetDebugScope(JSContext *cx, JSObject &obj)
     }
 
     Rooted<ScopeObject*> scope(cx, &obj.as<ScopeObject>());
-    if (AbstractFramePtr frame = DebugScopes::hasLiveFrame(*scope)) {
-        ScopeIter si(frame, *scope, cx);
+    if (ScopeIterVal *maybeLiveScope = DebugScopes::hasLiveScope(*scope)) {
+        ScopeIter si(*maybeLiveScope, cx);
         return GetDebugScope(cx, si);
     }
     ScopeIter si(scope->enclosingScope(), cx);
@@ -2094,12 +2142,12 @@ js::GetDebugScopeForFunction(JSContext *cx, HandleFunction fun)
 }
 
 JSObject *
-js::GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame)
+js::GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     assertSameCompartment(cx, frame);
     if (CanUseDebugScopeMaps(cx) && !DebugScopes::updateLiveScopes(cx))
         return nullptr;
-    ScopeIter si(frame, cx);
+    ScopeIter si(frame, pc, cx);
     return GetDebugScope(cx, si);
 }
 
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index f5eb96a4edf2..4dafb301719a 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -495,6 +495,7 @@ CloneStaticBlockObject(JSContext *cx, HandleObject enclosingScope, Handle<Static
 /*****************************************************************************/
 
 class ScopeIterKey;
+class ScopeIterVal;
 
 /*
  * A scope iterator describes the active scopes enclosing the current point of
@@ -512,6 +513,7 @@ class ScopeIterKey;
 class ScopeIter
 {
     friend class ScopeIterKey;
+    friend class ScopeIterVal;
 
   public:
     enum Type { Call, Block, With, StrictEvalScope };
@@ -534,22 +536,25 @@ class ScopeIter
   public:
 
     /* Constructing from a copy of an existing ScopeIter. */
-    explicit ScopeIter(const ScopeIter &si, JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ScopeIter(const ScopeIter &si, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     /* Constructing from StackFrame places ScopeIter on the innermost scope. */
-    explicit ScopeIter(AbstractFramePtr frame, JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ScopeIter(AbstractFramePtr frame, jsbytecode *pc, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     /*
      * Without a StackFrame, the resulting ScopeIter is done() with
      * enclosingScope() as given.
      */
-    explicit ScopeIter(JSObject &enclosingScope, JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ScopeIter(JSObject &enclosingScope, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     /* Like ScopeIter(StackFrame *) except start at 'scope'. */
-    ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
+    ScopeIter(AbstractFramePtr frame, jsbytecode *pc, ScopeObject &scope, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+
+    ScopeIter(const ScopeIterVal &hashVal, JSContext *cx
               MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     bool done() const { return !frame_; }
@@ -574,19 +579,24 @@ class ScopeIter
 
 class ScopeIterKey
 {
+    friend class ScopeIterVal;
+
     AbstractFramePtr frame_;
     JSObject *cur_;
     StaticBlockObject *block_;
     ScopeIter::Type type_;
+    bool hasScopeObject_;
 
   public:
-    ScopeIterKey() : frame_(NullFramePtr()), cur_(nullptr), block_(nullptr), type_() {}
     ScopeIterKey(const ScopeIter &si)
-      : frame_(si.frame_), cur_(si.cur_), block_(si.block_), type_(si.type_)
-    {}
+      : frame_(si.frame()), cur_(si.cur_), block_(si.block_), type_(si.type_),
+        hasScopeObject_(si.hasScopeObject_) {}
 
     AbstractFramePtr frame() const { return frame_; }
+    JSObject *cur() const { return cur_; }
+    StaticBlockObject *block() const { return block_; }
     ScopeIter::Type type() const { return type_; }
+    bool hasScopeObject() const { return hasScopeObject_; }
 
     /* For use as hash policy */
     typedef ScopeIterKey Lookup;
@@ -594,6 +604,26 @@ class ScopeIterKey
     static bool match(ScopeIterKey si1, ScopeIterKey si2);
 };
 
+class ScopeIterVal
+{
+    friend class ScopeIter;
+
+    AbstractFramePtr frame_;
+    RelocatablePtr<JSObject> cur_;
+    RelocatablePtr<StaticBlockObject> block_;
+    ScopeIter::Type type_;
+    bool hasScopeObject_;
+    
+    static void staticAsserts();
+
+  public:
+    ScopeIterVal(const ScopeIter &si)
+      : frame_(si.frame()), cur_(si.cur_), block_(si.block_), type_(si.type_),
+        hasScopeObject_(si.hasScopeObject_) {}
+
+    AbstractFramePtr frame() const { return frame_; }
+};
+
 /*****************************************************************************/
 
 /*
@@ -625,7 +655,7 @@ extern JSObject *
 GetDebugScopeForFunction(JSContext *cx, HandleFunction fun);
 
 extern JSObject *
-GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame);
+GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc);
 
 /* Provides debugger access to a scope. */
 class DebugScopeObject : public ProxyObject
@@ -683,7 +713,7 @@ class DebugScopes
      * updates of liveScopes need only fill in the new scopes.
      */
     typedef HashMap<ScopeObject *,
-                    AbstractFramePtr,
+                    ScopeIterVal,
                     DefaultHasher<ScopeObject *>,
                     RuntimeAllocPolicy> LiveScopeMap;
     LiveScopeMap liveScopes;
@@ -710,12 +740,13 @@ class DebugScopes
     static bool addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject &debugScope);
 
     static bool updateLiveScopes(JSContext *cx);
-    static AbstractFramePtr hasLiveFrame(ScopeObject &scope);
+    static ScopeIterVal *hasLiveScope(ScopeObject &scope);
 
     // In debug-mode, these must be called whenever exiting a scope that might
     // have stack-allocated locals.
     static void onPopCall(AbstractFramePtr frame, JSContext *cx);
-    static void onPopBlock(JSContext *cx, AbstractFramePtr frame);
+    static void onPopBlock(JSContext *cx, const ScopeIter &si);
+    static void onPopBlock(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc);
     static void onPopWith(AbstractFramePtr frame);
     static void onPopStrictEvalScope(AbstractFramePtr frame);
     static void onCompartmentLeaveDebugMode(JSCompartment *c);
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 4321c1d1f1b9..4f3e1a7dd3a3 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -995,9 +995,6 @@ InitialFrameFlagsAreConstructing(InitialFrameFlags initial)
     return !!(initial & INITIAL_CONSTRUCT);
 }
 
-inline AbstractFramePtr Valueify(JSAbstractFramePtr frame) { return AbstractFramePtr(frame); }
-static inline JSAbstractFramePtr Jsvalify(AbstractFramePtr frame)   { return JSAbstractFramePtr(frame.raw()); }
-
 /*****************************************************************************/
 
 class FrameRegs

From 44bd6e47905a8b5cd9a57d0b88d99eed12ba2d03 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 12:07:02 +0100
Subject: [PATCH 077/144] Bug 927782 - Part 11: Optimize block scopes without
 aliased locals. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 171 +++++++++++++++++-----------
 js/src/frontend/FullParseHandler.h  |   6 +-
 js/src/frontend/ParseNode.h         |   2 +-
 js/src/frontend/Parser.cpp          |  24 ++--
 js/src/jit/BaselineCompiler.cpp     | 101 ++++------------
 js/src/jit/BaselineCompiler.h       |  13 +--
 js/src/jit/BaselineFrame-inl.h      |  23 ++--
 js/src/jit/BaselineFrame.h          |   2 +-
 js/src/jit/IonBuilder.cpp           |  10 ++
 js/src/jit/VMFunctions.cpp          |   4 +-
 js/src/jit/VMFunctions.h            |   4 +-
 js/src/jsanalyze.cpp                |   1 -
 js/src/jsopcode.cpp                 |  33 +-----
 js/src/jsopcode.tbl                 |  29 ++---
 js/src/vm/Interpreter.cpp           |  75 ++++++------
 js/src/vm/Stack-inl.h               |   2 +-
 js/src/vm/Stack.cpp                 |  38 ++-----
 js/src/vm/Stack.h                   |  13 +--
 18 files changed, 234 insertions(+), 317 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index e69e982252ef..d566ded30448 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -141,15 +141,6 @@ EmitCheck(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t delta)
     return offset;
 }
 
-static StaticBlockObject &
-LastBlockAdded(BytecodeEmitter *bce, jsbytecode *pc)
-{
-    DebugOnly<uint32_t> index = GET_UINT32_INDEX(pc);
-    JS_ASSERT(index < bce->objectList.length);
-    JS_ASSERT(index == bce->objectList.length - 1);
-    return bce->objectList.lastbox->object->as<StaticBlockObject>();
-}
-
 static void
 UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)
 {
@@ -168,26 +159,8 @@ UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)
             bce->maxStackDepth = depth;
     }
 
-    /*
-     * Specially handle any case in which StackUses or StackDefs would call
-     * NumBlockSlots, since that requires a well-formed script. This allows us
-     * to safely pass nullptr as the 'script' parameter to StackUses and
-     * StackDefs.
-     */
-    int nuses, ndefs;
-    if (op == JSOP_ENTERBLOCK) {
-        nuses = 0;
-        ndefs = LastBlockAdded(bce, pc).slotCount();
-    } else if (op == JSOP_ENTERLET0) {
-        nuses = ndefs = LastBlockAdded(bce, pc).slotCount();
-    } else if (op == JSOP_ENTERLET1) {
-        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 1;
-    } else if (op == JSOP_ENTERLET2) {
-        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 2;
-    } else {
-        nuses = StackUses(nullptr, pc);
-        ndefs = StackDefs(nullptr, pc);
-    }
+    int nuses = StackUses(nullptr, pc);
+    int ndefs = StackDefs(nullptr, pc);
 
     bce->stackDepth -= nuses;
     JS_ASSERT(bce->stackDepth >= 0);
@@ -568,7 +541,10 @@ class NonLocalExitScope {
             return false;
         if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
             return false;
-        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
+        if (blockObj.needsClone()) {
+            if (Emit1(cx, bce, JSOP_POPBLOCKSCOPE) < 0)
+                return false;
+        }
         openScopeIndex = bce->blockScopeList.length() - 1;
         return true;
     }
@@ -623,11 +599,11 @@ NonLocalExitScope::prepareForNonLocalJump(StmtInfoBCE *toStmt)
         }
 
         if (stmt->isBlockScope) {
-            FLUSH_POPS();
             JS_ASSERT(stmt->blockObj);
             StaticBlockObject &blockObj = *stmt->blockObj;
             if (!popScopeForNonLocalExit(blockObj, stmt->blockScopeIndex))
                 return false;
+            npops += blockObj.slotCount();
         }
     }
 
@@ -773,6 +749,55 @@ ComputeAliasedSlots(ExclusiveContext *cx, BytecodeEmitter *bce, StaticBlockObjec
 static bool
 EmitInternedObjectOp(ExclusiveContext *cx, uint32_t index, JSOp op, BytecodeEmitter *bce);
 
+// ~ Block Scopes ~
+//
+// A block scope is a region of a script with an additional set of named
+// variables.  Those variables may be local and thus accessible directly from
+// the stack, or "aliased" and only accessible through the scope chain.
+//
+// A block scope may or may not have a corresponding link on the scope chain.
+// If no variable declared in the scope is "aliased", then no scope chain node
+// is allocated.
+//
+// To help debuggers, the bytecode emitter arranges to record the PC ranges
+// comprehended by a block scope, and ultimately attach them to the JSScript.
+// An element in the "block scope array" specifies the PC range, and links to a
+// StaticBlockObject in the object list of the script.  That block is linked to
+// the previous block in the scope, if any.  The static block chain at any
+// pre-retire PC can be retrieved using JSScript::getBlockScope(jsbytecode *pc).
+//
+// When PUSHBLOCKSCOPE is executed, it assumes that the block's locals are
+// already on the stack.  Initial values of "aliased" locals are copied from the
+// stack to the ClonedBlockObject, and no further access is made to the stack
+// slot.
+//
+// Likewise after leaving a POPBLOCKSCOPE, we will need to emit code to pop the
+// stack values.
+//
+// Finally, to assist the debugger, we also emit a DEBUGLEAVEBLOCK opcode before
+// POPBLOCKSCOPE in all cases -- even if the block has no aliased locals.  This
+// allows DebugScopes to invalidate any association between a debugger scope
+// object, which can proxy access to unaliased stack locals, and the actual live
+// frame.  In normal, non-debug mode, this opcode does not cause any baseline
+// code to be emitted.
+//
+// In this function "extraSlots" indicates the number of slots that are
+// "floating" on the stack above the scope's slots.  This will only be nonzero
+// in the case of for-let-in and for-let-of loops, where loop iterator state
+// floats above the block scopes.  It would be nice to fix this eventually so
+// that loop iterator state gets assigned to block-scoped fp-addressable
+// temporaries, instead of being addressable only via the sp.  This would also
+// make generators more efficient, as the loop state could be heap-allocated, so
+// that the value stack would likely be empty at yield points inside for-of /
+// for-in loops.
+//
+// Summary: Enter block scopes with EnterBlockScope.  It will emit
+// PUSHBLOCKSCOPE if needed.  Leave them with LeaveBlockScope, which will emit
+// DEBUGLEAVEBLOCK and may emit POPBLOCKSCOPE.  Pass EnterBlockScope a fresh
+// StmtInfoBCE object, and pass that same object to the corresponding
+// LeaveBlockScope.  Push locals before entering a scope, and pop them
+// afterwards.  Brush your teeth, and clean behind your ears!
+//
 static bool
 EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
                 unsigned extraSlots)
@@ -792,19 +817,13 @@ EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, O
     JS_ASSERT(depth >= 0);
     blockObj.setStackDepth(depth);
 
-    JSOp op;
-    switch (extraSlots) {
-      case 0: op = JSOP_ENTERLET0; break;
-      case 1: op = JSOP_ENTERLET1; break;
-      case 2: op = JSOP_ENTERLET2; break;
-      default: MOZ_ASSUME_UNREACHABLE("unexpected extraSlots");
-    }
-
     if (!ComputeAliasedSlots(cx, bce, blockObj))
         return false;
 
-    if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
-        return false;
+    if (blockObj.needsClone()) {
+        if (!EmitInternedObjectOp(cx, scopeObjectIndex, JSOP_PUSHBLOCKSCOPE, bce))
+            return false;
+    }
 
     stmt->blockScopeIndex = bce->blockScopeList.length();
     if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
@@ -837,7 +856,7 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
 }
 
 static bool
-LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
+LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce)
 {
     StmtInfoBCE *stmt = bce->topStmt;
     JS_ASSERT(stmt->isBlockScope);
@@ -852,7 +871,7 @@ LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
     JS_ASSERT(blockObj == bce->blockChain);
 #endif
 
-    uint32_t slotCount = bce->blockChain->slotCount();
+    bool blockOnChain = bce->blockChain->needsClone();
 
     if (!PopStatementBCE(cx, bce))
         return false;
@@ -862,8 +881,10 @@ LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
 
     bce->blockScopeList.recordEnd(blockScopeIndex, bce->offset());
 
-    JS_ASSERT(op == JSOP_LEAVEBLOCK || op == JSOP_LEAVEBLOCKEXPR);
-    EMIT_UINT16_IMM_OP(op, slotCount);
+    if (blockOnChain) {
+        if (Emit1(cx, bce, JSOP_POPBLOCKSCOPE) < 0)
+            return false;
+    }
 
     return true;
 }
@@ -2684,10 +2705,10 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
     }
 
-
     if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
-        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+        if (!LeaveBlockScope(cx, bce))
             return false;
+        EMIT_UINT16_IMM_OP(JSOP_POPN, blockObj->slotCount());
     } else {
         if (!PopStatementBCE(cx, bce))
             return false;
@@ -3983,7 +4004,8 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (ParseNode *pn2 = pn->pn_kid2) {
         // The emitted code for a catch block looks like:
         //
-        // enterblock
+        // undefined...                 as many as there are locals in the catch block
+        // [pushblockscope]             only if any local aliased
         // exception
         // if there is a catchguard:
         //   dup
@@ -3991,14 +4013,16 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         // if there is a catchguard:
         //   < catchguard code >
         //   ifne POST
-        //   throwing                   pop exception to cx->exception
         //   debugleaveblock
-        //   leaveblock
+        //   [popblockscope]            only if any local aliased
+        //   popnv <num block locals>   leave exception on top
+        //   throwing                   pop exception to cx->exception
         //   goto <next catch block>
         //   POST: pop
         // < catch block contents >
         // debugleaveblock
-        // leaveblock
+        // [popblockscope]              only if any local aliased
+        // popn <num block locals>
         // goto <end of catch blocks>   non-local; finally applies
         //
         // If there's no catch block without a catchguard, the last <next catch
@@ -4194,11 +4218,13 @@ EmitIf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
  *  destructure z
  *  pick 1
  *  pop               -1
- *  enterlet0
+ *  pushblockscope (if needed)
  *  evaluate e        +1
- *  leaveblockexpr    -3
+ *  debugleaveblock
+ *  popblockscope (if needed)
+ *  popnv 3           -3
  *
- * Note that, since enterlet0 simply changes fp->blockChain and does not
+ * Note that, since pushblockscope simply changes fp->scopeChain and does not
  * otherwise touch the stack, evaluation of the let-var initializers must leave
  * the initial value in the let-var's future slot.
  */
@@ -4236,9 +4262,13 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     if (!EmitTree(cx, bce, letBody->pn_expr))
         return false;
 
-    if (!LeaveBlockScope(cx, bce, letBody->getOp()))
+    if (!LeaveBlockScope(cx, bce))
         return false;
 
+    JSOp leaveOp = letBody->getOp();
+    JS_ASSERT(leaveOp == JSOP_POPN || leaveOp == JSOP_POPNV);
+    EMIT_UINT16_IMM_OP(leaveOp, blockObj->slotCount());
+
     return true;
 }
 
@@ -4250,7 +4280,7 @@ MOZ_NEVER_INLINE static bool
 EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
-    JS_ASSERT(pn->getOp() == JSOP_LEAVEBLOCK);
+    JS_ASSERT(pn->getOp() == JSOP_POPN);
 
     StmtInfoBCE stmtInfo(cx);
     ObjectBox *objbox = pn->pn_objbox;
@@ -4268,9 +4298,11 @@ EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!EmitTree(cx, bce, pn->pn_expr))
         return false;
 
-    if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+    if (!LeaveBlockScope(cx, bce))
         return false;
 
+    EMIT_UINT16_IMM_OP(JSOP_POPN, slots);
+
     return true;
 }
 
@@ -4440,14 +4472,14 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    // Pop result and iter.
-    EMIT_UINT16_IMM_OP(JSOP_POPN, 2);
-
     if (letDecl) {
-        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+        if (!LeaveBlockScope(cx, bce))
             return false;
     }
 
+    // Pop result, iter, and slots from the lexical block (if any).
+    EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount + 2);
+
     return true;
 }
 
@@ -4468,20 +4500,24 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         /*
          * The let's slot(s) will be under the iterator, but the block must not
-         * be entered (i.e. fp->blockChain set) until after evaluating the rhs.
-         * Thus, push to reserve space and enterblock after. The same argument
-         * applies when leaving the loop. Thus, a for-let-in loop looks like:
+         * be entered until after evaluating the rhs.  So, we reserve space for
+         * the block scope now, and only push the block onto the scope chain
+         * later.  Thus, a for-let-in loop looks like:
          *
          *   push x N
          *   eval rhs
          *   iter
-         *   enterlet1
+         *   pushblockscope (if needed)
          *   goto
          *     ... loop body
          *   ifne
-         *   leaveforinlet
+         *   debugleaveblock
+         *   popblockscope (if needed)
          *   enditer
          *   popn(N)
+         *
+         * Note that pushblockscope and popblockscope only get emitted if some
+         * of the variables in the block are captured.
          */
         for (uint32_t i = 0; i < blockObjCount; ++i) {
             if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
@@ -4600,8 +4636,9 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
         return false;
 
     if (letDecl) {
-        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+        if (!LeaveBlockScope(cx, bce))
             return false;
+        EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount);
     }
 
     return true;
diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h
index aba7792d6a4a..0eb9f37b657b 100644
--- a/js/src/frontend/FullParseHandler.h
+++ b/js/src/frontend/FullParseHandler.h
@@ -603,9 +603,9 @@ FullParseHandler::addCatchBlock(ParseNode *catchList, ParseNode *letBlock,
 inline void
 FullParseHandler::setLeaveBlockResult(ParseNode *block, ParseNode *kid, bool leaveBlockExpr)
 {
-    JS_ASSERT(block->isOp(JSOP_LEAVEBLOCK));
+    JS_ASSERT(block->isOp(JSOP_POPN));
     if (leaveBlockExpr)
-        block->setOp(JSOP_LEAVEBLOCKEXPR);
+        block->setOp(JSOP_POPNV);
     block->pn_expr = kid;
 }
 
@@ -637,7 +637,7 @@ FullParseHandler::newLexicalScope(ObjectBox *blockbox)
     if (!pn)
         return nullptr;
 
-    pn->setOp(JSOP_LEAVEBLOCK);
+    pn->setOp(JSOP_POPN);
     pn->pn_objbox = blockbox;
     pn->pn_cookie.makeFree();
     pn->pn_dflags = 0;
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 39fdd2efa173..b00c0425b7a5 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -407,7 +407,7 @@ enum ParseNodeKind
  * PNK_NULL,
  * PNK_THIS
  *
- * PNK_LEXICALSCOPE name    pn_op: JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR
+ * PNK_LEXICALSCOPE name    pn_op: JSOP_POPN or JSOP_POPNV
  *                          pn_objbox: block object in ObjectBox holder
  *                          pn_expr: block body
  * PNK_ARRAYCOMP    list    pn_count: 1
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 3702596a7c0e..b458d1cf67ea 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -3231,7 +3231,6 @@ Parser<FullParseHandler>::pushLetScope(HandleStaticBlockObject blockObj, StmtInf
     if (!pn)
         return null();
 
-    /* Tell codegen to emit JSOP_ENTERLETx (not JSOP_ENTERBLOCK). */
     pn->pn_dflags |= PND_LET;
 
     /* Populate the new scope with decls found in the head with updated blockid. */
@@ -3601,7 +3600,7 @@ Parser<FullParseHandler>::letDeclaration()
             if (!pn1)
                 return null();
 
-            pn1->setOp(JSOP_LEAVEBLOCK);
+            pn1->setOp(JSOP_POPN);
             pn1->pn_pos = pc->blockNode->pn_pos;
             pn1->pn_objbox = blockbox;
             pn1->pn_expr = pc->blockNode;
@@ -3637,8 +3636,8 @@ Parser<FullParseHandler>::letStatement()
     if (tokenStream.peekToken() == TOK_LP) {
         pn = letBlock(LetStatement);
         JS_ASSERT_IF(pn, pn->isKind(PNK_LET) || pn->isKind(PNK_SEMI));
-        JS_ASSERT_IF(pn && pn->isKind(PNK_LET) && pn->pn_expr->getOp() != JSOP_LEAVEBLOCK,
-                     pn->isOp(JSOP_NOP));
+        JS_ASSERT_IF(pn && pn->isKind(PNK_LET) && pn->pn_expr->getOp() != JSOP_POPNV,
+                     pn->pn_expr->isOp(JSOP_POPN));
     } else 
         pn = letDeclaration();
     return pn;
@@ -6718,16 +6717,21 @@ Parser<ParseHandler>::arrayInitializer()
          *
          * Each let () {...} or for (let ...) ... compiles to:
          *
-         *   JSOP_ENTERBLOCK <o> ... JSOP_LEAVEBLOCK <n>
+         *   JSOP_PUSHN <N>            // Push space for block-scoped locals.
+         *   (JSOP_PUSHBLOCKSCOPE <O>) // If a local is aliased, push on scope
+         *                             // chain.
+         *   ...
+         *   JSOP_DEBUGLEAVEBLOCK      // Invalidate any DebugScope proxies.
+         *   JSOP_POPBLOCKSCOPE?       // Pop off scope chain, if needed.
+         *   JSOP_POPN <N>             // Pop space for block-scoped locals.
          *
          * where <o> is a literal object representing the block scope,
          * with <n> properties, naming each var declared in the block.
          *
-         * Each var declaration in a let-block binds a name in <o> at
-         * compile time, and allocates a slot on the operand stack at
-         * runtime via JSOP_ENTERBLOCK. A block-local var is accessed by
-         * the JSOP_GETLOCAL and JSOP_SETLOCAL ops. These ops have an
-         * immediate operand, the local slot's stack index from fp->spbase.
+         * Each var declaration in a let-block binds a name in <o> at compile
+         * time. A block-local var is accessed by the JSOP_GETLOCAL and
+         * JSOP_SETLOCAL ops. These ops have an immediate operand, the local
+         * slot's stack index from fp->spbase.
          *
          * The array comprehension iteration step, array.push(i * j) in
          * the example above, is done by <i * j>; JSOP_ARRAYPUSH <array>,
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 60592925193a..a188d127b9a7 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -860,6 +860,15 @@ BaselineCompiler::emit_JSOP_POPN()
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_POPNV()
+{
+    frame.popRegsAndSync(1);
+    frame.popn(GET_UINT16(pc));
+    frame.push(R0);
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_DUP()
 {
@@ -2575,23 +2584,14 @@ BaselineCompiler::emit_JSOP_RETSUB()
     return emitOpIC(stubCompiler.getStub(&stubSpace_));
 }
 
-typedef bool (*EnterBlockFn)(JSContext *, BaselineFrame *, Handle<StaticBlockObject *>);
-static const VMFunction EnterBlockInfo = FunctionInfo<EnterBlockFn>(jit::EnterBlock);
+typedef bool (*PushBlockScopeFn)(JSContext *, BaselineFrame *, Handle<StaticBlockObject *>);
+static const VMFunction PushBlockScopeInfo = FunctionInfo<PushBlockScopeFn>(jit::PushBlockScope);
 
 bool
-BaselineCompiler::emitEnterBlock()
+BaselineCompiler::emit_JSOP_PUSHBLOCKSCOPE()
 {
     StaticBlockObject &blockObj = script->getObject(pc)->as<StaticBlockObject>();
 
-    if (JSOp(*pc) == JSOP_ENTERBLOCK) {
-        for (size_t i = 0; i < blockObj.slotCount(); i++)
-            frame.push(UndefinedValue());
-
-        // Pushed values will be accessed using GETLOCAL and SETLOCAL, so ensure
-        // they are synced.
-        frame.syncStack(0);
-    }
-
     // Call a stub to push the block on the block chain.
     prepareVMCall();
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
@@ -2599,31 +2599,22 @@ BaselineCompiler::emitEnterBlock()
     pushArg(ImmGCPtr(&blockObj));
     pushArg(R0.scratchReg());
 
-    return callVM(EnterBlockInfo);
+    return callVM(PushBlockScopeInfo);
 }
 
-bool
-BaselineCompiler::emit_JSOP_ENTERBLOCK()
-{
-    return emitEnterBlock();
-}
+typedef bool (*PopBlockScopeFn)(JSContext *, BaselineFrame *);
+static const VMFunction PopBlockScopeInfo = FunctionInfo<PopBlockScopeFn>(jit::PopBlockScope);
 
 bool
-BaselineCompiler::emit_JSOP_ENTERLET0()
+BaselineCompiler::emit_JSOP_POPBLOCKSCOPE()
 {
-    return emitEnterBlock();
-}
+    // Call a stub to pop the block from the block chain.
+    prepareVMCall();
 
-bool
-BaselineCompiler::emit_JSOP_ENTERLET1()
-{
-    return emitEnterBlock();
-}
+    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(R0.scratchReg());
 
-bool
-BaselineCompiler::emit_JSOP_ENTERLET2()
-{
-    return emitEnterBlock();
+    return callVM(PopBlockScopeInfo);
 }
 
 typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *, jsbytecode *);
@@ -2643,56 +2634,6 @@ BaselineCompiler::emit_JSOP_DEBUGLEAVEBLOCK()
     return callVM(DebugLeaveBlockInfo);
 }
 
-typedef bool (*LeaveBlockFn)(JSContext *, BaselineFrame *);
-static const VMFunction LeaveBlockInfo = FunctionInfo<LeaveBlockFn>(jit::LeaveBlock);
-
-bool
-BaselineCompiler::emitLeaveBlock()
-{
-    // Call a stub to pop the block from the block chain.
-    prepareVMCall();
-
-    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
-    pushArg(R0.scratchReg());
-
-    return callVM(LeaveBlockInfo);
-}
-
-bool
-BaselineCompiler::emit_JSOP_LEAVEBLOCK()
-{
-    if (!emitLeaveBlock())
-        return false;
-
-    // Pop slots pushed by JSOP_ENTERBLOCK.
-    frame.popn(GET_UINT16(pc));
-    return true;
-}
-
-bool
-BaselineCompiler::emit_JSOP_LEAVEBLOCKEXPR()
-{
-    if (!emitLeaveBlock())
-        return false;
-
-    // Pop slots pushed by JSOP_ENTERBLOCK, but leave the topmost value
-    // on the stack.
-    frame.popRegsAndSync(1);
-    frame.popn(GET_UINT16(pc));
-    frame.push(R0);
-    return true;
-}
-
-bool
-BaselineCompiler::emit_JSOP_LEAVEFORLETIN()
-{
-    if (!emitLeaveBlock())
-        return false;
-
-    // Another op will pop the slots (after the enditer).
-    return true;
-}
-
 typedef bool (*GetAndClearExceptionFn)(JSContext *, MutableHandleValue);
 static const VMFunction GetAndClearExceptionInfo =
     FunctionInfo<GetAndClearExceptionFn>(GetAndClearException);
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index a72ceb5e358e..8cc0432ddf11 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -27,6 +27,7 @@ namespace jit {
     _(JSOP_NOTEARG)            \
     _(JSOP_POP)                \
     _(JSOP_POPN)               \
+    _(JSOP_POPNV)              \
     _(JSOP_DUP)                \
     _(JSOP_DUP2)               \
     _(JSOP_SWAP)               \
@@ -145,13 +146,8 @@ namespace jit {
     _(JSOP_FINALLY)            \
     _(JSOP_GOSUB)              \
     _(JSOP_RETSUB)             \
-    _(JSOP_ENTERBLOCK)         \
-    _(JSOP_ENTERLET0)          \
-    _(JSOP_ENTERLET1)          \
-    _(JSOP_ENTERLET2)          \
-    _(JSOP_LEAVEBLOCK)         \
-    _(JSOP_LEAVEBLOCKEXPR)     \
-    _(JSOP_LEAVEFORLETIN)      \
+    _(JSOP_PUSHBLOCKSCOPE)     \
+    _(JSOP_POPBLOCKSCOPE)      \
     _(JSOP_DEBUGLEAVEBLOCK)    \
     _(JSOP_EXCEPTION)          \
     _(JSOP_DEBUGGER)           \
@@ -255,9 +251,6 @@ class BaselineCompiler : public BaselineCompilerSpecific
 
     bool emitFormalArgAccess(uint32_t arg, bool get);
 
-    bool emitEnterBlock();
-    bool emitLeaveBlock();
-
     bool addPCMappingEntry(bool addIndexEntry);
 
     void getScopeCoordinateObject(Register reg);
diff --git a/js/src/jit/BaselineFrame-inl.h b/js/src/jit/BaselineFrame-inl.h
index 234dae4d1969..d4702eaace10 100644
--- a/js/src/jit/BaselineFrame-inl.h
+++ b/js/src/jit/BaselineFrame-inl.h
@@ -36,31 +36,22 @@ BaselineFrame::popOffScopeChain()
 inline bool
 BaselineFrame::pushBlock(JSContext *cx, Handle<StaticBlockObject *> block)
 {
-    JS_ASSERT_IF(hasBlockChain(), blockChain() == *block->enclosingBlock());
+    JS_ASSERT(block->needsClone());
 
-    if (block->needsClone()) {
-        ClonedBlockObject *clone = ClonedBlockObject::create(cx, block, this);
-        if (!clone)
-            return false;
+    ClonedBlockObject *clone = ClonedBlockObject::create(cx, block, this);
+    if (!clone)
+        return false;
+    pushOnScopeChain(*clone);
 
-        pushOnScopeChain(*clone);
-    }
-
-    setBlockChain(*block);
     return true;
 }
 
 inline void
 BaselineFrame::popBlock(JSContext *cx)
 {
-    JS_ASSERT(hasBlockChain());
+    JS_ASSERT(scopeChain_->is<ClonedBlockObject>());
 
-    if (blockChain_->needsClone()) {
-        JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
-        popOffScopeChain();
-    }
-
-    setBlockChain(*blockChain_->enclosingBlock());
+    popOffScopeChain();
 }
 
 inline CallObject &
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index 32d92b1fcaf3..99504d6b4cb3 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -169,7 +169,7 @@ class BaselineFrame
 
     Value &unaliasedLocal(unsigned i, MaybeCheckAliasing checkAliasing = CHECK_ALIASING) const {
 #ifdef DEBUG
-        CheckLocalUnaliased(checkAliasing, script(), maybeBlockChain(), i);
+        CheckLocalUnaliased(checkAliasing, script(), i);
 #endif
         return *valueSlot(i);
     }
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 28b2285a8fdc..ef0a2e6b7986 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1252,6 +1252,7 @@ IonBuilder::traverseBytecode()
             switch (op) {
               case JSOP_POP:
               case JSOP_POPN:
+              case JSOP_POPNV:
               case JSOP_DUP:
               case JSOP_DUP2:
               case JSOP_PICK:
@@ -1504,6 +1505,15 @@ IonBuilder::inspectOpcode(JSOp op)
             current->pop();
         return true;
 
+      case JSOP_POPNV:
+      {
+        MDefinition *mins = current->pop();
+        for (uint32_t i = 0, n = GET_UINT16(pc); i < n; i++)
+            current->pop();
+        current->push(mins);
+        return true;
+      }
+
       case JSOP_NEWINIT:
         if (GET_UINT8(pc) == JSProto_Array)
             return jsop_newarray(0);
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index da14ed83316c..b7b4f061be41 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -883,13 +883,13 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
 }
 
 bool
-EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block)
+PushBlockScope(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block)
 {
     return frame->pushBlock(cx, block);
 }
 
 bool
-LeaveBlock(JSContext *cx, BaselineFrame *frame)
+PopBlockScope(JSContext *cx, BaselineFrame *frame)
 {
     frame->popBlock(cx);
     return true;
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 037b76a5042a..a5ccb4f255c4 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -652,8 +652,8 @@ JSObject *InitRestParameter(JSContext *cx, uint32_t length, Value *rest, HandleO
 bool HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, bool *mustReturn);
 bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn);
 
-bool EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
-bool LeaveBlock(JSContext *cx, BaselineFrame *frame);
+bool PushBlockScope(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
+bool PopBlockScope(JSContext *cx, BaselineFrame *frame);
 bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame, jsbytecode *pc);
 
 bool InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame,
diff --git a/js/src/jsanalyze.cpp b/js/src/jsanalyze.cpp
index ba4ec3a5e30c..912ea0be1152 100644
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -253,7 +253,6 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
 
           case JSOP_EVAL:
           case JSOP_SPREADEVAL:
-          case JSOP_ENTERLET2:
           case JSOP_ENTERWITH:
             canTrackVars = false;
             break;
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index cb8d3f25f27d..91607c264f49 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -114,18 +114,6 @@ js_GetVariableBytecodeLength(jsbytecode *pc)
     }
 }
 
-static uint32_t
-NumBlockSlots(JSScript *script, jsbytecode *pc)
-{
-    JS_ASSERT(*pc == JSOP_ENTERBLOCK ||
-              *pc == JSOP_ENTERLET0 || *pc == JSOP_ENTERLET1 || *pc == JSOP_ENTERLET2);
-    JS_STATIC_ASSERT(JSOP_ENTERBLOCK_LENGTH == JSOP_ENTERLET0_LENGTH);
-    JS_STATIC_ASSERT(JSOP_ENTERBLOCK_LENGTH == JSOP_ENTERLET1_LENGTH);
-    JS_STATIC_ASSERT(JSOP_ENTERBLOCK_LENGTH == JSOP_ENTERLET2_LENGTH);
-
-    return script->getObject(GET_UINT32_INDEX(pc))->as<StaticBlockObject>().propertyCountForCompilation();
-}
-
 unsigned
 js::StackUses(JSScript *script, jsbytecode *pc)
 {
@@ -138,16 +126,8 @@ js::StackUses(JSScript *script, jsbytecode *pc)
     switch (op) {
       case JSOP_POPN:
         return GET_UINT16(pc);
-      case JSOP_LEAVEBLOCK:
-        return GET_UINT16(pc);
-      case JSOP_LEAVEBLOCKEXPR:
+      case JSOP_POPNV:
         return GET_UINT16(pc) + 1;
-      case JSOP_ENTERLET0:
-        return NumBlockSlots(script, pc);
-      case JSOP_ENTERLET1:
-        return NumBlockSlots(script, pc) + 1;
-      case JSOP_ENTERLET2:
-        return NumBlockSlots(script, pc) + 2;
       default:
         /* stack: fun, this, [argc arguments] */
         JS_ASSERT(op == JSOP_NEW || op == JSOP_CALL || op == JSOP_EVAL ||
@@ -161,15 +141,8 @@ js::StackDefs(JSScript *script, jsbytecode *pc)
 {
     JSOp op = (JSOp) *pc;
     const JSCodeSpec &cs = js_CodeSpec[op];
-    if (cs.ndefs >= 0)
-        return cs.ndefs;
-
-    uint32_t n = NumBlockSlots(script, pc);
-    if (op == JSOP_ENTERLET1)
-        return n + 1;
-    if (op == JSOP_ENTERLET2)
-        return n + 2;
-    return n;
+    JS_ASSERT (cs.ndefs >= 0);
+    return cs.ndefs;
 }
 
 static const char * const countBaseNames[] = {
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index 0e419e58a800..9bc672f5c4eb 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -97,7 +97,9 @@ OPDEF(JSOP_SPREADNEW, 42, "spreadnew",  NULL,         1,  3,  1, JOF_BYTE|JOF_IN
 /* spreadcall variant of JSOP_EVAL */
 OPDEF(JSOP_SPREADEVAL,43, "spreadeval", NULL,         1,  3,  1, JOF_BYTE|JOF_INVOKE|JOF_TYPESET)
 
-OPDEF(JSOP_UNUSED44,  44, "unused44",   NULL,         1,  0,  0,  JOF_BYTE)
+/* Pop N values, preserving top value.  */
+OPDEF(JSOP_POPNV,     44, "popnv",      NULL,         3, -1,  1,  JOF_UINT16)
+
 OPDEF(JSOP_UNUSED45,  45, "unused45",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED46,  46, "unused46",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED47,  47, "unused47",   NULL,         1,  0,  0,  JOF_BYTE)
@@ -220,9 +222,7 @@ OPDEF(JSOP_UNUSED101,  101, "unused101",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED102,  102, "unused102",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED103,  103, "unused103",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED104,  104, "unused104",   NULL,         1,  0,  0,  JOF_BYTE)
-
-/* Leave a for-let-in block leaving its storage pushed (to be popped after enditer). */
-OPDEF(JSOP_LEAVEFORLETIN, 105,"leaveforletin",NULL,   1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED105,  105, "unused105",   NULL,         1,  0,  0,  JOF_BYTE)
 
 /* The argument is the offset to the next statement and is used by IonMonkey. */
 OPDEF(JSOP_LABEL,     106,"label",     NULL,          5,  0,  0,  JOF_JUMP)
@@ -398,13 +398,9 @@ OPDEF(JSOP_UNUSED183,     183,"unused183",  NULL,     1,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_CALLPROP,      184,"callprop",   NULL,     5,  1,  1, JOF_ATOM|JOF_PROP|JOF_TYPESET|JOF_TMPSLOT3)
 
-/* Enter a let block/expr whose slots are at the top of the stack. */
-OPDEF(JSOP_ENTERLET0,     185,"enterlet0",  NULL,     5, -1, -1,  JOF_OBJECT)
-
-/* Enter a let block/expr whose slots are 1 below the top of the stack. */
-OPDEF(JSOP_ENTERLET1,     186,"enterlet1",  NULL,     5, -1, -1,  JOF_OBJECT)
-/* Enter a let block/expr whose slots are 2 below the top of the stack. */
-OPDEF(JSOP_ENTERLET2,     187,"enterlet2",  NULL,     5, -1, -1,  JOF_OBJECT)
+OPDEF(JSOP_UNUSED185,     185,"unused185",  NULL,     1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED186,     186,"unused186",  NULL,     1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED187,     187,"unused187",  NULL,     1,  0,  0,  JOF_BYTE)
 
 /*
  * Opcode to hold 24-bit immediate integer operands.
@@ -436,8 +432,8 @@ OPDEF(JSOP_TYPEOFEXPR,    197,"typeofexpr",  NULL,    1,  1,  1, JOF_BYTE|JOF_DE
 /*
  * Block-local scope support.
  */
-OPDEF(JSOP_ENTERBLOCK,    198,"enterblock",  NULL,    5,  0, -1,  JOF_OBJECT)
-OPDEF(JSOP_LEAVEBLOCK,    199,"leaveblock",  NULL,    3, -1,  0,  JOF_UINT16)
+OPDEF(JSOP_PUSHBLOCKSCOPE,198,"pushblockscope", NULL, 5,  0,  0,  JOF_OBJECT)
+OPDEF(JSOP_POPBLOCKSCOPE, 199,"popblockscope", NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_DEBUGLEAVEBLOCK, 200,"debugleaveblock", NULL, 1,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_UNUSED201,     201,"unused201",  NULL,     1,  0,  0,  JOF_BYTE)
@@ -459,12 +455,7 @@ OPDEF(JSOP_GETFUNNS,      205,"getfunns",   NULL,     1,  0,  1,  JOF_BYTE)
  */
 OPDEF(JSOP_ENUMCONSTELEM, 206,"enumconstelem",NULL,   1,  3,  0,  JOF_BYTE|JOF_SET)
 
-/*
- * Variant of JSOP_LEAVEBLOCK has a result on the stack above the locals,
- * which must be moved down when the block pops.
- */
-OPDEF(JSOP_LEAVEBLOCKEXPR,207,"leaveblockexpr",NULL,  3, -1,  1,  JOF_UINT16)
-
+OPDEF(JSOP_UNUSED207,     207, "unused207",    NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED208,     208, "unused208",    NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED209,     209, "unused209",    NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED210,     210, "unused210",    NULL,  1,  0,  0,  JOF_BYTE)
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index d25eda18bfa1..7f03056a48a9 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -854,8 +854,8 @@ js::UnwindScope(JSContext *cx, ScopeIter &si, uint32_t stackDepth)
                 return;
             if (cx->compartment()->debugMode())
                 DebugScopes::onPopBlock(cx, si);
-            JS_ASSERT(&si.staticBlock() == si.frame().maybeBlockChain());
-            si.frame().popBlock(cx);
+            if (si.staticBlock().needsClone())
+                si.frame().popBlock(cx);
             break;
           case ScopeIter::With:
             if (si.scope().as<WithObject>().stackDepth() < stackDepth)
@@ -1589,7 +1589,6 @@ CASE(EnableInterruptsPseudoOpcode)
 /* Various 1-byte no-ops. */
 CASE(JSOP_NOP)
 CASE(JSOP_UNUSED2)
-CASE(JSOP_UNUSED44)
 CASE(JSOP_UNUSED45)
 CASE(JSOP_UNUSED46)
 CASE(JSOP_UNUSED47)
@@ -1602,6 +1601,7 @@ CASE(JSOP_UNUSED101)
 CASE(JSOP_UNUSED102)
 CASE(JSOP_UNUSED103)
 CASE(JSOP_UNUSED104)
+CASE(JSOP_UNUSED105)
 CASE(JSOP_UNUSED107)
 CASE(JSOP_UNUSED125)
 CASE(JSOP_UNUSED126)
@@ -1641,6 +1641,9 @@ CASE(JSOP_UNUSED180)
 CASE(JSOP_UNUSED181)
 CASE(JSOP_UNUSED182)
 CASE(JSOP_UNUSED183)
+CASE(JSOP_UNUSED185)
+CASE(JSOP_UNUSED186)
+CASE(JSOP_UNUSED187)
 CASE(JSOP_UNUSED189)
 CASE(JSOP_UNUSED190)
 CASE(JSOP_UNUSED191)
@@ -1649,6 +1652,7 @@ CASE(JSOP_UNUSED194)
 CASE(JSOP_UNUSED196)
 CASE(JSOP_UNUSED201)
 CASE(JSOP_GETFUNNS)
+CASE(JSOP_UNUSED207)
 CASE(JSOP_UNUSED208)
 CASE(JSOP_UNUSED209)
 CASE(JSOP_UNUSED210)
@@ -1714,11 +1718,24 @@ CASE(JSOP_POPN)
     JS_ASSERT(GET_UINT16(REGS.pc) <= REGS.stackDepth());
     REGS.sp -= GET_UINT16(REGS.pc);
 #ifdef DEBUG
-    if (StaticBlockObject *block = REGS.fp()->maybeBlockChain())
+    if (StaticBlockObject *block = script->getBlockScope(REGS.pc + JSOP_POPN_LENGTH))
         JS_ASSERT(REGS.stackDepth() >= block->stackDepth() + block->slotCount());
 #endif
 END_CASE(JSOP_POPN)
 
+CASE(JSOP_POPNV)
+{
+    JS_ASSERT(GET_UINT16(REGS.pc) < REGS.stackDepth());
+    Value val = REGS.sp[-1];
+    REGS.sp -= GET_UINT16(REGS.pc);
+    REGS.sp[-1] = val;
+#ifdef DEBUG
+    if (StaticBlockObject *block = script->getBlockScope(REGS.pc + JSOP_POPNV_LENGTH))
+        JS_ASSERT(REGS.stackDepth() >= block->stackDepth() + block->slotCount());
+#endif
+}
+END_CASE(JSOP_POPNV)
+
 CASE(JSOP_SETRVAL)
     POP_RETURN_VALUE();
 END_CASE(JSOP_SETRVAL)
@@ -3336,52 +3353,36 @@ CASE(JSOP_DEBUGGER)
 }
 END_CASE(JSOP_DEBUGGER)
 
-CASE(JSOP_ENTERBLOCK)
-CASE(JSOP_ENTERLET0)
-CASE(JSOP_ENTERLET1)
-CASE(JSOP_ENTERLET2)
+CASE(JSOP_PUSHBLOCKSCOPE)
 {
     StaticBlockObject &blockObj = script->getObject(REGS.pc)->as<StaticBlockObject>();
 
-    if (*REGS.pc == JSOP_ENTERBLOCK) {
-        JS_ASSERT(REGS.stackDepth() == blockObj.stackDepth());
-        JS_ASSERT(REGS.stackDepth() + blockObj.slotCount() <= script->nslots());
-        Value *vp = REGS.sp + blockObj.slotCount();
-        SetValueRangeToUndefined(REGS.sp, vp);
-        REGS.sp = vp;
-    }
+    JS_ASSERT(blockObj.needsClone());
+    // FIXME: "Aliased" slots don't need to be on the stack.
+    JS_ASSERT(REGS.stackDepth() >= blockObj.stackDepth() + blockObj.slotCount());
 
-    /* Clone block iff there are any closed-over variables. */
+    // Clone block and push on scope chain.
     if (!REGS.fp()->pushBlock(cx, blockObj))
         goto error;
 }
-END_CASE(JSOP_ENTERBLOCK)
+END_CASE(JSOP_PUSHBLOCKSCOPE)
 
-CASE(JSOP_LEAVEBLOCK)
-CASE(JSOP_LEAVEFORLETIN)
-CASE(JSOP_LEAVEBLOCKEXPR)
+CASE(JSOP_POPBLOCKSCOPE)
 {
-    blockDepth = REGS.fp()->blockChain().stackDepth();
+#ifdef DEBUG
+    // Pop block from scope chain.
+    JS_ASSERT(*(REGS.pc - JSOP_DEBUGLEAVEBLOCK_LENGTH) == JSOP_DEBUGLEAVEBLOCK);
+    StaticBlockObject *blockObj = script->getBlockScope(REGS.pc - JSOP_DEBUGLEAVEBLOCK_LENGTH);
+    JS_ASSERT(blockObj && blockObj->needsClone());
+
+    // FIXME: "Aliased" slots don't need to be on the stack.
+    JS_ASSERT(REGS.stackDepth() >= blockObj->stackDepth() + blockObj->slotCount());
+#endif
 
     // Pop block from scope chain.
     REGS.fp()->popBlock(cx);
-
-    if (*REGS.pc == JSOP_LEAVEBLOCK) {
-        /* Pop the block's slots. */
-        REGS.sp -= GET_UINT16(REGS.pc);
-        JS_ASSERT(REGS.stackDepth() == blockDepth);
-    } else if (*REGS.pc == JSOP_LEAVEBLOCKEXPR) {
-        /* Pop the block's slots maintaining the topmost expr. */
-        Value *vp = &REGS.sp[-1];
-        REGS.sp -= GET_UINT16(REGS.pc);
-        JS_ASSERT(REGS.stackDepth() == blockDepth + 1);
-        REGS.sp[-1] = *vp;
-    } else {
-        /* Another op will pop; nothing to do here. */
-        ADVANCE_AND_DISPATCH(JSOP_LEAVEFORLETIN_LENGTH);
-    }
 }
-END_CASE(JSOP_LEAVEBLOCK)
+END_CASE(JSOP_POPBLOCKSCOPE)
 
 CASE(JSOP_DEBUGLEAVEBLOCK)
 {
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 4e47e88d9f45..3e0766f5b68c 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -110,7 +110,7 @@ inline Value &
 StackFrame::unaliasedLocal(unsigned i, MaybeCheckAliasing checkAliasing)
 {
 #ifdef DEBUG
-    CheckLocalUnaliased(checkAliasing, script(), maybeBlockChain(), i);
+    CheckLocalUnaliased(checkAliasing, script(), i);
 #endif
     return slots()[i];
 }
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index dcb8ea9ae6a9..46066d02d7ee 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -327,20 +327,14 @@ StackFrame::epilogue(JSContext *cx)
 bool
 StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
 {
-    JS_ASSERT_IF(hasBlockChain(), blockChain_ == block.enclosingBlock());
+    JS_ASSERT (block.needsClone());
 
-    if (block.needsClone()) {
-        Rooted<StaticBlockObject *> blockHandle(cx, &block);
-        ClonedBlockObject *clone = ClonedBlockObject::create(cx, blockHandle, this);
-        if (!clone)
-            return false;
+    Rooted<StaticBlockObject *> blockHandle(cx, &block);
+    ClonedBlockObject *clone = ClonedBlockObject::create(cx, blockHandle, this);
+    if (!clone)
+        return false;
 
-        pushOnScopeChain(*clone);
-
-        blockChain_ = blockHandle;
-    } else {
-        blockChain_ = &block;
-    }
+    pushOnScopeChain(*clone);
 
     return true;
 }
@@ -348,12 +342,8 @@ StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
 void
 StackFrame::popBlock(JSContext *cx)
 {
-    if (blockChain_->needsClone()) {
-        JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
-        popOffScopeChain();
-    }
-
-    blockChain_ = blockChain_->enclosingBlock();
+    JS_ASSERT(scopeChain_->is<ClonedBlockObject>());
+    popOffScopeChain();
 }
 
 void
@@ -1254,8 +1244,7 @@ AbstractFramePtr::hasPushedSPSFrame() const
 
 #ifdef DEBUG
 void
-js::CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script,
-                        StaticBlockObject *maybeBlock, unsigned i)
+js::CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script, unsigned i)
 {
     if (!checkAliasing)
         return;
@@ -1264,13 +1253,8 @@ js::CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script,
     if (i < script->nfixed()) {
         JS_ASSERT(!script->varIsAliased(i));
     } else {
-        unsigned depth = i - script->nfixed();
-        for (StaticBlockObject *b = maybeBlock; b; b = b->enclosingBlock()) {
-            if (b->containsVarAtDepth(depth)) {
-                JS_ASSERT(!b->isAliased(depth - b->stackDepth()));
-                break;
-            }
-        }
+        // FIXME: The callers of this function do not easily have the PC of the
+        // current frame, and so they do not know the block scope.
     }
 }
 #endif
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 4f3e1a7dd3a3..81540bd01af3 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -75,8 +75,7 @@ enum MaybeCheckAliasing { CHECK_ALIASING = true, DONT_CHECK_ALIASING = false };
 
 #ifdef DEBUG
 extern void
-CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script,
-                    StaticBlockObject *maybeBlock, unsigned i);
+CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script, unsigned i);
 #endif
 
 namespace jit {
@@ -591,14 +590,8 @@ class StackFrame
     inline void popOffScopeChain();
 
     /*
-     * Block chain
-     *
-     * Entering/leaving a let (or exception) block may do 1 or 2 things: First,
-     * a static block object (created at compiled time and stored in the
-     * script) is pushed on StackFrame::blockChain. Second, if the static block
-     * may be cloned to hold the dynamic values if this is needed for dynamic
-     * scope access. A clone is created for a static block iff
-     * StaticBlockObject::needsClone.
+     * For blocks with aliased locals, these interfaces push and pop entries on
+     * the scope chain.
      */
 
     bool hasBlockChain() const {

From 9441939663621e9807d7ab3b9ed6f2be6b521f6c Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 12:17:08 +0100
Subject: [PATCH 078/144] Bug 927782 - Part 12: Remove blockChain from
 StackFrame. r=luke

---
 js/src/jit/BaselineBailouts.cpp |  4 ----
 js/src/jit/BaselineCompiler.cpp |  2 --
 js/src/jit/BaselineFrame.cpp    |  2 --
 js/src/jit/BaselineFrame.h      | 27 +++------------------------
 js/src/jit/BaselineFrameInfo.h  |  3 ---
 js/src/vm/Stack-inl.h           | 13 -------------
 js/src/vm/Stack.cpp             |  2 --
 js/src/vm/Stack.h               | 15 ---------------
 8 files changed, 3 insertions(+), 65 deletions(-)

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index 9fd0fc07fc10..ff6b70468b37 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -612,10 +612,6 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
     if (argsObj)
         blFrame->initArgsObjUnchecked(*argsObj);
 
-    // Ion doesn't compile code with try/catch, so the block object will always be
-    // null.
-    blFrame->setBlockChainNull();
-
     if (fun) {
         // The unpacked thisv and arguments should overwrite the pushed args present
         // in the calling frame.
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index a188d127b9a7..cfdedd195c37 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -289,8 +289,6 @@ BaselineCompiler::emitPrologue()
     else
         masm.storePtr(R1.scratchReg(), frame.addressOfScopeChain());
 
-    masm.storePtr(ImmPtr(nullptr), frame.addressOfBlockChain());
-
     // Functions with a large number of locals require two stack checks.
     // The VMCall for a fallible stack check can only occur after the
     // scope chain has been initialized, as that is required for proper
diff --git a/js/src/jit/BaselineFrame.cpp b/js/src/jit/BaselineFrame.cpp
index 82ca90ca60ca..a8b4ffffaca4 100644
--- a/js/src/jit/BaselineFrame.cpp
+++ b/js/src/jit/BaselineFrame.cpp
@@ -113,8 +113,6 @@ BaselineFrame::initForOsr(StackFrame *fp, uint32_t numStackValues)
     if (fp->hasCallObjUnchecked())
         flags_ |= BaselineFrame::HAS_CALL_OBJ;
 
-    blockChain_ = fp->maybeBlockChain();
-
     if (fp->isEvalFrame()) {
         flags_ |= BaselineFrame::EVAL;
         evalScript_ = fp->script();
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index 99504d6b4cb3..d1a03a4a5b09 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -69,11 +69,13 @@ class BaselineFrame
     uint32_t hiReturnValue_;
     uint32_t frameSize_;
     JSObject *scopeChain_;          // Scope chain (always initialized).
-    StaticBlockObject *blockChain_; // The static block chain.
     JSScript *evalScript_;          // If isEvalFrame(), the current eval script.
     ArgumentsObject *argsObj_;      // If HAS_ARGS_OBJ, the arguments object.
     void *hookData_;                // If HAS_HOOK_DATA, debugger call hook data.
     uint32_t flags_;
+#if JS_BITS_PER_WORD == 32
+    uint32_t padding_;              // Pad to 8-byte alignment.
+#endif
 
   public:
     // Distance between the frame pointer and the frame header (return address).
@@ -209,26 +211,6 @@ class BaselineFrame
         return reinterpret_cast<Value *>(&loReturnValue_);
     }
 
-    bool hasBlockChain() const {
-        return blockChain_;
-    }
-    StaticBlockObject &blockChain() const {
-        JS_ASSERT(hasBlockChain());
-        return *blockChain_;
-    }
-    StaticBlockObject *maybeBlockChain() const {
-        return hasBlockChain() ? blockChain_ : nullptr;
-    }
-    void setBlockChain(StaticBlockObject &block) {
-        blockChain_ = &block;
-    }
-    void setBlockChainNull() {
-        blockChain_ = nullptr;
-    }
-    StaticBlockObject **addressOfBlockChain() {
-        return &blockChain_;
-    }
-
     bool hasCallObj() const {
         return flags_ & HAS_CALL_OBJ;
     }
@@ -378,9 +360,6 @@ class BaselineFrame
     static int reverseOffsetOfScopeChain() {
         return -int(Size()) + offsetof(BaselineFrame, scopeChain_);
     }
-    static int reverseOffsetOfBlockChain() {
-        return -int(Size()) + offsetof(BaselineFrame, blockChain_);
-    }
     static int reverseOffsetOfArgsObj() {
         return -int(Size()) + offsetof(BaselineFrame, argsObj_);
     }
diff --git a/js/src/jit/BaselineFrameInfo.h b/js/src/jit/BaselineFrameInfo.h
index fd4bfc33e3a1..38527e969072 100644
--- a/js/src/jit/BaselineFrameInfo.h
+++ b/js/src/jit/BaselineFrameInfo.h
@@ -284,9 +284,6 @@ class FrameInfo
     Address addressOfScopeChain() const {
         return Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfScopeChain());
     }
-    Address addressOfBlockChain() const {
-        return Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfBlockChain());
-    }
     Address addressOfFlags() const {
         return Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfFlags());
     }
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 3e0766f5b68c..fd7088222f91 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -85,8 +85,6 @@ StackFrame::initCallFrame(JSContext *cx, StackFrame *prev, jsbytecode *prevpc, V
     prev_ = prev;
     prevpc_ = prevpc;
     prevsp_ = prevsp;
-    blockChain_= nullptr;
-    JS_ASSERT(!hasBlockChain());
     JS_ASSERT(!hasHookData());
 
     initVarsToUndefined();
@@ -516,17 +514,6 @@ AbstractFramePtr::unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing)
 #endif
 }
 
-inline StaticBlockObject *
-AbstractFramePtr::maybeBlockChain() const
-{
-    if (isStackFrame())
-        return asStackFrame()->maybeBlockChain();
-#ifdef JS_ION
-    return asBaselineFrame()->maybeBlockChain();
-#else
-    MOZ_ASSUME_UNREACHABLE("Invalid frame");
-#endif
-}
 inline bool
 AbstractFramePtr::hasCallObj() const
 {
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 46066d02d7ee..491bf8cc417a 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -81,7 +81,6 @@ StackFrame::initExecuteFrame(JSContext *cx, JSScript *script, AbstractFramePtr e
     prev_ = nullptr;
     prevpc_ = nullptr;
     prevsp_ = nullptr;
-    blockChain_ = nullptr;
 
     JS_ASSERT_IF(evalInFramePrev, isDebuggerFrame());
     evalInFramePrev_ = evalInFramePrev;
@@ -273,7 +272,6 @@ void
 StackFrame::epilogue(JSContext *cx)
 {
     JS_ASSERT(!isYielding());
-    JS_ASSERT(!hasBlockChain());
 
     RootedScript script(cx, this->script());
     probes::ExitScript(cx, script, script->function(), hasPushedSPSFrame());
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 81540bd01af3..e8d4e71479c7 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -178,7 +178,6 @@ class AbstractFramePtr
 
     inline JSCompartment *compartment() const;
 
-    inline StaticBlockObject *maybeBlockChain() const;
     inline bool hasCallObj() const;
     inline bool isGeneratorFrame() const;
     inline bool isYielding() const;
@@ -337,7 +336,6 @@ class StackFrame
     } u;
     mutable JSObject    *scopeChain_;   /* if HAS_SCOPECHAIN, current scope chain */
     Value               rval_;          /* if HAS_RVAL, return value of the frame */
-    StaticBlockObject   *blockChain_;   /* innermost let block */
     ArgumentsObject     *argsObj_;      /* if HAS_ARGS_OBJ, the call's arguments object */
 
     /*
@@ -594,19 +592,6 @@ class StackFrame
      * the scope chain.
      */
 
-    bool hasBlockChain() const {
-        return blockChain_;
-    }
-
-    StaticBlockObject *maybeBlockChain() {
-        return blockChain_;
-    }
-
-    StaticBlockObject &blockChain() const {
-        JS_ASSERT(hasBlockChain());
-        return *blockChain_;
-    }
-
     bool pushBlock(JSContext *cx, StaticBlockObject &block);
     void popBlock(JSContext *cx);
 

From 34adadfd732e73beb2e847cf59613b933fc9d2dd Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 18:45:24 -0800
Subject: [PATCH 079/144] Bumping gaia.json for 3 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/38a1fd737228
Author: steveck-chung <schung@mozilla.com>
Desc: Merge pull request #14539 from steveck-chung/message-timestamp-changes

Bug 944881 - Gaia should interpret timestamps as long-long numbers. r=julienw, a=blocking-b2g 1.3+

========

https://hg.mozilla.org/integration/gaia-central/rev/1190eb0646f1
Author: Steve Chung <schung@mozilla.com>
Desc: Utilize Date.now() and other fixing.

========

https://hg.mozilla.org/integration/gaia-central/rev/aa7004ea3513
Author: Steve Chung <schung@mozilla.com>
Desc: Bug 944881 - Gaia should interpret timestamps as long-long numbers
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 32baa9dd5e1b..bbc015ce4931 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "9271d94f35a54995e4442da711e51cff0244741d", 
+    "revision": "38a1fd73722896def7fbe38e8241dd21682174fd", 
     "repo_path": "/integration/gaia-central"
 }

From 6956f6ac23a96367cb6848f280a7b5efa8c162d6 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 19:50:26 -0800
Subject: [PATCH 080/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/b715601fc835
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Merge pull request #14624 from timdream/statusbar-animation-icon

Bug 946173 - Update and remove unused and duplicate status bar icon files, r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/8c8045a17061
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Bug 946173 - Update and remove unused and duplicate status bar icon files
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index bbc015ce4931..3f985d8717e1 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "38a1fd73722896def7fbe38e8241dd21682174fd", 
+    "revision": "b715601fc8358c0845513265f6b1f77545014b39", 
     "repo_path": "/integration/gaia-central"
 }

From 4db577c98713a19d7a39d3e89b6c294221505c96 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 20:00:24 -0800
Subject: [PATCH 081/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/7849a5c8e80c
Author: steveck-chung <schung@mozilla.com>
Desc: Merge pull request #14596 from steveck-chung/DSDS-sim_switch_for_MMS

Bug 949326 - [DSDS][MMS] Switching data call follow-up fixing for default service ID type changes, r=julienw

========

https://hg.mozilla.org/integration/gaia-central/rev/08e6e42168f8
Author: Steve Chung <schung@mozilla.com>
Desc: Bug 949326 - [DSDS][MMS] Switching data call follow-up fixing for default service ID type changes
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3f985d8717e1..bf1f66a09162 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "b715601fc8358c0845513265f6b1f77545014b39", 
+    "revision": "7849a5c8e80c3ebd953d14532d7274a15f75c580", 
     "repo_path": "/integration/gaia-central"
 }

From d3f11c2705f0c8fa3e545c908dc8a07016301a3f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 20:25:24 -0800
Subject: [PATCH 082/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/cb7228e13dd0
Author: Rex KM Lee <rexboy@mozilla.com>
Desc: Merge pull request #14523 from rexboy7/fix-bug917221

Bug 917221 - [Dialer] Support merging group call by Bluetooth CHLD=3 com... r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/45b3a22c1903
Author: Rex Lee <rexboy@mozilla.com>
Desc: Bug 917221 - [Dialer] Support merging group call by Bluetooth CHLD=3 command.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index bf1f66a09162..fdf8927b561a 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "7849a5c8e80c3ebd953d14532d7274a15f75c580", 
+    "revision": "cb7228e13dd0018400dfd857c83d7498a7ce2a0e", 
     "repo_path": "/integration/gaia-central"
 }

From 154bf6ca66280f1cc0a8aa7be9f79ea5c6cf998f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 21:00:24 -0800
Subject: [PATCH 083/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

========

https://hg.mozilla.org/integration/gaia-central/rev/3c3706bd5581
Author: Corey Frang <gnarf37@gmail.com>
Desc: Bug 921317 – [Gaia] Transform Animation in the clock app is wrong - r=jugglinmike

- Allow hashchange to initiate navigation instead of emitting 'selected' event from tabs
- Remove emitter from tabs since it doesn't need to emit anything anymore

========

https://hg.mozilla.org/integration/gaia-central/rev/fdfbe5e1411c
Author: Corey Frang <gnarf37@gmail.com>
Desc: Revert Temporary Workaround from Bug 926587

Revert "Bug 926587 - [B2G][Clock][Stopwatch] Choppy transition animation going to Stopwatch from Timer or Alarm - r=jugglinmike"

This reverts commit af77086d88d66ba75dc040e4cd2fa6990be2b0bf.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index fdf8927b561a..222fb636b924 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "cb7228e13dd0018400dfd857c83d7498a7ce2a0e", 
+    "revision": "3c3706bd5581eb1ff85449470892ae0dabc5ab6b", 
     "repo_path": "/integration/gaia-central"
 }

From 768d80e554aa3c5d9c62bcfee73baf7696c5b84e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 22:30:34 -0800
Subject: [PATCH 084/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/4b602663e947
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14566 from alivedise/bugzilla/943717/app-window-factory-creation

Bug 943717 - Refine Instantication of AppWindow and ActivityWindow, r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/dca37d4995f5
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 943717 - Refine Instantication of AppWindow and ActivityWindow
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 222fb636b924..ab32304ef5e7 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "3c3706bd5581eb1ff85449470892ae0dabc5ab6b", 
+    "revision": "4b602663e947f6c97d8fbeed277b613844d5beec", 
     "repo_path": "/integration/gaia-central"
 }

From 5a1c3abd8bb25cddf7f6304dfe2e196d7ca12b31 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:05:24 -0800
Subject: [PATCH 085/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/4c5a91931b02
Author: Albert <acperez@tid.es>
Desc: Merge pull request #13485 from acperez/bug-929602

Bug 929602 - Disable setting of origin in metadata.json in external apps

========

https://hg.mozilla.org/integration/gaia-central/rev/af7ef73156ab
Author: Albert <acperez@tid.es>
Desc: Bug 929602 - Disable setting of origin in metadata.json in external apps
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ab32304ef5e7..ef8706df884b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "4b602663e947f6c97d8fbeed277b613844d5beec", 
+    "revision": "4c5a91931b023b478749b69d85f18312d592e990", 
     "repo_path": "/integration/gaia-central"
 }

From 238e95eb1bb30d81742de2d43da1f1ecccaee893 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:20:23 -0800
Subject: [PATCH 086/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/b6e1e929530d
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14415 from julienw/fix-invalid-recipient-width

Bug 946744 - [Messages] Long invalid recipients makes the recipient pane...

========

https://hg.mozilla.org/integration/gaia-central/rev/9d26171cc2d1
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 946744 - [Messages] Long invalid recipients makes the recipient panel horizontally scrollable r=borja

Uses box-sizing: border-box to have something consistent between recipient
states
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ef8706df884b..6916e83fb734 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "4c5a91931b023b478749b69d85f18312d592e990", 
+    "revision": "b6e1e929530dad55c8d55868cd46e4cafc0cdc73", 
     "repo_path": "/integration/gaia-central"
 }

From 9f1dc1ed479823a9f9e9e86169e581f00a9e6a7e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:30:24 -0800
Subject: [PATCH 087/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/fae1a0c2fe5e
Author: Greg Weng <snowmantw@gmail.com>
Desc: Merge pull request #14630 from snowmantw/issue948789

Bug 948789 - Lockscreen can be unlocked without using normal gestures

========

https://hg.mozilla.org/integration/gaia-central/rev/9390b461e7e9
Author: Greg Weng (snowmantw) <gweng@mozilla.com>
Desc: Bug 948789 - Lockscreen can be unlocked without using normal gestures
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6916e83fb734..051f630a8d07 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "b6e1e929530dad55c8d55868cd46e4cafc0cdc73", 
+    "revision": "fae1a0c2fe5efa9bfdad0855270cabb40849562f", 
     "repo_path": "/integration/gaia-central"
 }

From 7944cb8b87f8d0a73b32a69fd563a2a8007c0a89 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 15:31:16 +0800
Subject: [PATCH 088/144] Bug 939441: B2G Bluetooth: add test cases for
 navigator.BluetoothManager.enabled. r=echou, f=jgriffin

---
 dom/bluetooth/tests/marionette/head.js        | 172 ++++++++++++++++++
 dom/bluetooth/tests/marionette/manifest.ini   |   6 +
 .../test_dom_BluetoothManager_enabled.js      |  64 +++++++
 .../client/marionette/tests/unit-tests.ini    |   1 +
 4 files changed, 243 insertions(+)
 create mode 100644 dom/bluetooth/tests/marionette/head.js
 create mode 100644 dom/bluetooth/tests/marionette/manifest.ini
 create mode 100644 dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js

diff --git a/dom/bluetooth/tests/marionette/head.js b/dom/bluetooth/tests/marionette/head.js
new file mode 100644
index 000000000000..78b82ab7e050
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/head.js
@@ -0,0 +1,172 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=2 sts=2 et filetype=javascript
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+let Promise =
+  SpecialPowers.Cu.import("resource://gre/modules/Promise.jsm").Promise;
+
+let bluetoothManager;
+
+/* Get mozSettings value specified by @aKey.
+ *
+ * Resolve if that mozSettings value is retrieved successfully, reject
+ * otherwise.
+ *
+ * Forfill params:
+ *   The corresponding mozSettings value of the key.
+ * Reject params: (none)
+ *
+ * @param aKey
+ *        A string.
+ *
+ * @return A deferred promise.
+ */
+function getSettings(aKey) {
+  let deferred = Promise.defer();
+
+  let request = navigator.mozSettings.createLock().get(aKey);
+  request.addEventListener("success", function(aEvent) {
+    ok(true, "getSettings(" + aKey + ")");
+    deferred.resolve(aEvent.target.result[aKey]);
+  });
+  request.addEventListener("error", function() {
+    ok(false, "getSettings(" + aKey + ")");
+    deferred.reject();
+  });
+
+  return deferred.promise;
+}
+
+/* Set mozSettings values.
+ *
+ * Resolve if that mozSettings value is set successfully, reject otherwise.
+ *
+ * Forfill params: (none)
+ * Reject params: (none)
+ *
+ * @param aSettings
+ *        An object of format |{key1: value1, key2: value2, ...}|.
+ *
+ * @return A deferred promise.
+ */
+function setSettings(aSettings) {
+  let deferred = Promise.defer();
+
+  let request = navigator.mozSettings.createLock().set(aSettings);
+  request.addEventListener("success", function() {
+    ok(true, "setSettings(" + JSON.stringify(aSettings) + ")");
+    deferred.resolve();
+  });
+  request.addEventListener("error", function() {
+    ok(false, "setSettings(" + JSON.stringify(aSettings) + ")");
+    deferred.reject();
+  });
+
+  return deferred.promise;
+}
+
+/* Get mozSettings value of 'bluetooth.enabled'.
+ *
+ * Resolve if that mozSettings value is retrieved successfully, reject
+ * otherwise.
+ *
+ * Forfill params:
+ *   A boolean value.
+ * Reject params: (none)
+ *
+ * @return A deferred promise.
+ */
+function getBluetoothEnabled() {
+  return getSettings("bluetooth.enabled");
+}
+
+/* Set mozSettings value of 'bluetooth.enabled'.
+ *
+ * Resolve if that mozSettings value is set successfully, reject otherwise.
+ *
+ * Forfill params: (none)
+ * Reject params: (none)
+ *
+ * @param aEnabled
+ *        A boolean value.
+ *
+ * @return A deferred promise.
+ */
+function setBluetoothEnabled(aEnabled) {
+  let obj = {};
+  obj["bluetooth.enabled"] = aEnabled;
+  return setSettings(obj);
+}
+
+/* Push required permissions and test if |navigator.mozBluetooth| exists.
+ * Resolve if it does, reject otherwise.
+ *
+ * Forfill params:
+ *   bluetoothManager -- an reference to navigator.mozBluetooth.
+ * Reject params: (none)
+ *
+ * @param aPermissions
+ *        Additional permissions to push before any test cases.  Could be either
+ *        a string or an array of strings.
+ *
+ * @return A deferred promise.
+ */
+function ensureBluetoothManager(aPermissions) {
+  let deferred = Promise.defer();
+
+  let permissions = ["bluetooth"];
+  if (aPermissions) {
+    if (Array.isArray(aPermissions)) {
+      permissions = permissions.concat(aPermissions);
+    } else if (typeof aPermissions == "string") {
+      permissions.push(aPermissions);
+    }
+  }
+
+  let obj = [];
+  for (let perm of permissions) {
+    obj.push({
+      "type": perm,
+      "allow": 1,
+      "context": document,
+    });
+  }
+
+  SpecialPowers.pushPermissions(obj, function() {
+    ok(true, "permissions pushed: " + JSON.stringify(permissions));
+
+    bluetoothManager = window.navigator.mozBluetooth;
+    log("navigator.mozBluetooth is " +
+        (bluetoothManager ? "available" : "unavailable"));
+
+    if (bluetoothManager instanceof BluetoothManager) {
+      deferred.resolve(bluetoothManager);
+    } else {
+      deferred.reject();
+    }
+  });
+
+  return deferred.promise;
+}
+
+/* Flush permission settings and call |finish()|.
+ */
+function cleanUp() {
+  SpecialPowers.flushPermissions(function() {
+    // Use ok here so that we have at least one test run.
+    ok(true, "permissions flushed");
+
+    finish();
+  });
+}
+
+function startBluetoothTestBase(aPermissions, aTestCaseMain) {
+  ensureBluetoothManager(aPermissions)
+    .then(aTestCaseMain)
+    .then(cleanUp, function() {
+      ok(false, "Unhandled rejected promise.");
+      cleanUp();
+    });
+}
diff --git a/dom/bluetooth/tests/marionette/manifest.ini b/dom/bluetooth/tests/marionette/manifest.ini
new file mode 100644
index 000000000000..710020cc7daf
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/manifest.ini
@@ -0,0 +1,6 @@
+[DEFAULT]
+b2g = true
+browser = false
+qemu = true
+
+[test_dom_BluetoothManager_enabled.js]
diff --git a/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js
new file mode 100644
index 000000000000..15ccedcac302
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js
@@ -0,0 +1,64 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=2 sts=2 et filetype=javascript
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+let enabledEventReceived;
+function onEnabled() {
+  enabledEventReceived = true;
+}
+
+let disabledEventReceived;
+function onDisabled() {
+  disabledEventReceived = true;
+}
+
+function test(aEnabled) {
+  log("Testing 'bluetooth.enabled' => " + aEnabled);
+
+  let deferred = Promise.defer();
+
+  enabledEventReceived = false;
+  disabledEventReceived = false;
+
+  setBluetoothEnabled(aEnabled).then(function() {
+    log("  Settings set. Waiting 3 seconds and examine results.");
+
+    window.setTimeout(function() {
+      is(bluetoothManager.enabled, aEnabled, "bluetoothManager.enabled");
+      is(enabledEventReceived, aEnabled, "enabledEventReceived");
+      is(disabledEventReceived, !aEnabled, "disabledEventReceived");
+
+      if (bluetoothManager.enabled === aEnabled &&
+          enabledEventReceived === aEnabled &&
+          disabledEventReceived === !aEnabled) {
+        deferred.resolve();
+      } else {
+        deferred.reject();
+      }
+    }, 3000);
+  });
+
+  return deferred.promise;
+}
+
+startBluetoothTestBase(["settings-read", "settings-write"],
+                       function testCaseMain() {
+  bluetoothManager.addEventListener("enabled", onEnabled);
+  bluetoothManager.addEventListener("disabled", onDisabled);
+
+  return getBluetoothEnabled()
+    .then(function(aEnabled) {
+      log("Original 'bluetooth.enabled' is " + aEnabled);
+      // Set to !aEnabled and reset back to aEnabled.
+      return test(!aEnabled).then(test.bind(null, aEnabled));
+    })
+    .then(function() {
+      bluetoothManager.removeEventListener("enabled", onEnabled);
+      bluetoothManager.removeEventListener("disabled", onDisabled);
+    });
+});
diff --git a/testing/marionette/client/marionette/tests/unit-tests.ini b/testing/marionette/client/marionette/tests/unit-tests.ini
index d6ba1b6dfd9e..b6eddaa23bf8 100644
--- a/testing/marionette/client/marionette/tests/unit-tests.ini
+++ b/testing/marionette/client/marionette/tests/unit-tests.ini
@@ -15,6 +15,7 @@ skip = false
 [include:unit/unit-tests.ini]
 
 ; webapi tests
+[include:../../../../../dom/bluetooth/tests/marionette/manifest.ini]
 [include:../../../../../dom/telephony/test/marionette/manifest.ini]
 [include:../../../../../dom/voicemail/test/marionette/manifest.ini]
 [include:../../../../../dom/battery/test/marionette/manifest.ini]

From 0867faba06ba1110afe3a779c3d24dc35ac8eb62 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 15:31:21 +0800
Subject: [PATCH 089/144] Bug 939637: B2G Bluetooth: add test case for
 navigator.BluetoothManager.adapteradded. r=echou

---
 dom/bluetooth/tests/marionette/head.js        | 108 ++++++++++++++++++
 dom/bluetooth/tests/marionette/manifest.ini   |   1 +
 .../test_dom_BluetoothManager_adapteradded.js |  44 +++++++
 3 files changed, 153 insertions(+)
 create mode 100644 dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js

diff --git a/dom/bluetooth/tests/marionette/head.js b/dom/bluetooth/tests/marionette/head.js
index 78b82ab7e050..e5eaca2173ce 100644
--- a/dom/bluetooth/tests/marionette/head.js
+++ b/dom/bluetooth/tests/marionette/head.js
@@ -151,6 +151,81 @@ function ensureBluetoothManager(aPermissions) {
   return deferred.promise;
 }
 
+/* Wait for one named BluetoothManager event.
+ *
+ * Resolve if that named event occurs.  Never reject.
+ *
+ * Forfill params: the DOMEvent passed.
+ *
+ * @return A deferred promise.
+ */
+function waitForManagerEvent(aEventName) {
+  let deferred = Promise.defer();
+
+  bluetoothManager.addEventListener(aEventName, function onevent(aEvent) {
+    bluetoothManager.removeEventListener(aEventName, onevent);
+
+    ok(true, "BluetoothManager event '" + aEventName + "' got.");
+    deferred.resolve(aEvent);
+  });
+
+  return deferred.promise;
+}
+
+/* Convenient function for setBluetoothEnabled and waitForManagerEvent
+ * combined.
+ *
+ * Resolve if that named event occurs.  Reject if we can't set settings.
+ *
+ * Forfill params: the DOMEvent passed.
+ * Reject params: (none)
+ *
+ * @return A deferred promise.
+ */
+function setBluetoothEnabledAndWait(aEnabled) {
+  return setBluetoothEnabled(aEnabled)
+    .then(waitForManagerEvent.bind(null, aEnabled ? "enabled" : "disabled"));
+}
+
+/* Get default adapter.
+ *
+ * Resolve if that default adapter is got, reject otherwise.
+ *
+ * Forfill params: a BluetoothAdapter instance.
+ * Reject params: a DOMError, or null if if there is no adapter ready yet.
+ *
+ * @return A deferred promise.
+ */
+function getDefaultAdapter() {
+  let deferred = Promise.defer();
+
+  let request = bluetoothManager.getDefaultAdapter();
+  request.onsuccess = function(aEvent) {
+    let adapter = aEvent.target.result;
+    if (!(adapter instanceof BluetoothAdapter)) {
+      ok(false, "no BluetoothAdapter ready yet.");
+      deferred.reject(null);
+      return;
+    }
+
+    ok(true, "BluetoothAdapter got.");
+    // TODO: We have an adapter instance now, but some of its attributes may
+    // still remain unassigned/out-dated.  Here we waste a few seconds to
+    // wait for the property changed events.
+    //
+    // See https://bugzilla.mozilla.org/show_bug.cgi?id=932914
+    window.setTimeout(function() {
+      deferred.resolve(adapter);
+    }, 3000);
+  };
+  request.onerror = function(aEvent) {
+    ok(false, "Failed to get default adapter.");
+    deferred.reject(aEvent.target.error);
+  };
+
+  return deferred.promise;
+}
+
 /* Flush permission settings and call |finish()|.
  */
 function cleanUp() {
@@ -170,3 +245,36 @@ function startBluetoothTestBase(aPermissions, aTestCaseMain) {
       cleanUp();
     });
 }
+
+function startBluetoothTest(aReenable, aTestCaseMain) {
+  startBluetoothTestBase(["settings-read", "settings-write"], function() {
+    let origEnabled, needEnable;
+
+    return getBluetoothEnabled()
+      .then(function(aEnabled) {
+        origEnabled = aEnabled;
+        needEnable = !aEnabled;
+        log("Original 'bluetooth.enabled' is " + origEnabled);
+
+        if (aEnabled && aReenable) {
+          log("  Disable 'bluetooth.enabled' ...");
+          needEnable = true;
+          return setBluetoothEnabledAndWait(false);
+        }
+      })
+      .then(function() {
+        if (needEnable) {
+          log("  Enable 'bluetooth.enabled' ...");
+          return setBluetoothEnabledAndWait(true)
+            .then(waitForManagerEvent.bind(null, "adapteradded"));
+        }
+      })
+      .then(getDefaultAdapter)
+      .then(aTestCaseMain)
+      .then(function() {
+        if (!origEnabled) {
+          return setBluetoothEnabledAndWait(false);
+        }
+      });
+  });
+}
diff --git a/dom/bluetooth/tests/marionette/manifest.ini b/dom/bluetooth/tests/marionette/manifest.ini
index 710020cc7daf..6ccb13c6f138 100644
--- a/dom/bluetooth/tests/marionette/manifest.ini
+++ b/dom/bluetooth/tests/marionette/manifest.ini
@@ -4,3 +4,4 @@ browser = false
 qemu = true
 
 [test_dom_BluetoothManager_enabled.js]
+[test_dom_BluetoothManager_adapteradded.js]
diff --git a/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js
new file mode 100644
index 000000000000..9c0dee3e60f0
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=2 sts=2 et filetype=javascript
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+// https://github.com/mozilla-b2g/platform_external_qemu/blob/master/vl-android.c#L765
+// static int bt_hci_parse(const char *str) {
+//   ...
+//   bdaddr.b[0] = 0x52;
+//   bdaddr.b[1] = 0x54;
+//   bdaddr.b[2] = 0x00;
+//   bdaddr.b[3] = 0x12;
+//   bdaddr.b[4] = 0x34;
+//   bdaddr.b[5] = 0x56 + nb_hcis;
+const EMULATOR_ADDRESS = "56:34:12:00:54:52";
+
+// $ adb shell hciconfig /dev/ttyS2 name
+// hci0:  Type: BR/EDR  Bus: UART
+//        BD Address: 56:34:12:00:54:52  ACL MTU: 512:1  SCO MTU: 0:0
+//        Name: 'Full Android on Emulator'
+const EMULATOR_NAME = "Full Android on Emulator";
+
+// $ adb shell hciconfig /dev/ttyS2 class
+// hci0:  Type: BR/EDR  Bus: UART
+//        BD Address: 56:34:12:00:54:52  ACL MTU: 512:1  SCO MTU: 0:0
+//        Class: 0x58020c
+//        Service Classes: Capturing, Object Transfer, Telephony
+//        Device Class: Phone, Smart phone
+const EMULATOR_CLASS = 0x58020c;
+
+startBluetoothTest(true, function testCaseMain(aAdapter) {
+  log("Checking adapter attributes ...");
+
+  is(aAdapter.name, EMULATOR_NAME, "adapter.name");
+  is(aAdapter.class, EMULATOR_CLASS, "adapter.class");
+  is(aAdapter.address, EMULATOR_ADDRESS, "adapter.address");
+  is(aAdapter.discovering, false, "adapter.discovering");
+  is(aAdapter.discoverable, false, "adapter.discoverable");
+  is(aAdapter.discoverableTimeout, 120, "adapter.discoverableTimeout");
+});

From d49f95e7c5e7e31ee694e98cce6020e4cf8fcb06 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:45:24 -0800
Subject: [PATCH 090/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/c5fa2dc97777
Author: ochameau <poirot.alex@gmail.com>
Desc: Merge pull request #14537 from ochameau/simulator-1

Bug 948462 - Fix SIMULATOR=1. r=yurenyu

========

https://hg.mozilla.org/integration/gaia-central/rev/dbaf8879327d
Author: Alexandre Poirot <poirot.alex@gmail.com>
Desc: Bug 948462 - Fix SIMULATOR=1. r=yurenyu
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 051f630a8d07..7bb9803eccd4 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "fae1a0c2fe5efa9bfdad0855270cabb40849562f", 
+    "revision": "c5fa2dc97777833bc1e69862cec075ca4bfa35e0", 
     "repo_path": "/integration/gaia-central"
 }

From 33e327ae7daf8a82c831cb3918a0e961aaf8cd1d Mon Sep 17 00:00:00 2001
From: Hsin-Yi Tsai <htsai@mozilla.com>
Date: Fri, 6 Dec 2013 16:02:28 +0800
Subject: [PATCH 091/144] Bug 944262 - part1 - [B2G]On conference call,we can't
 switch the speaker between off and on. r=vicamo

---
 dom/telephony/gonk/TelephonyProvider.js | 62 +++++++++++++++++++------
 1 file changed, 49 insertions(+), 13 deletions(-)

diff --git a/dom/telephony/gonk/TelephonyProvider.js b/dom/telephony/gonk/TelephonyProvider.js
index 2016951b2c18..5a88c2ff8f09 100644
--- a/dom/telephony/gonk/TelephonyProvider.js
+++ b/dom/telephony/gonk/TelephonyProvider.js
@@ -83,6 +83,32 @@ XPCOMUtils.defineLazyGetter(this, "gPhoneNumberUtils", function () {
   return ns.PhoneNumberUtils;
 });
 
+function SingleCall(options){
+  this.clientId = options.clientId;
+  this.callIndex = options.callIndex;
+  this.state = options.state;
+  this.number = options.number;
+  this.isOutgoing = options.isOutgoing;
+  this.isEmergency = options.isEmergency;
+  this.isConference = options.isConference;
+}
+SingleCall.prototype = {
+  clientId: null,
+  callIndex: null,
+  state: null,
+  number: null,
+  isOutgoing: false,
+  isEmergency: false,
+  isConference: false
+};
+
+function ConferenceCall(state){
+  this.state = state;
+}
+ConferenceCall.prototype = {
+  state: null
+};
+
 function TelephonyProvider() {
   this._numClients = gRadioInterfaceLayer.numRadioInterfaces;
   this._listeners = [];
@@ -162,14 +188,11 @@ TelephonyProvider.prototype = {
     }
   },
 
-  _matchActiveCall: function _matchActiveCall(aCall) {
-    if (this._activeCall &&
-        this._activeCall.callIndex == aCall.callIndex &&
-        this._activeCall.clientId == aCall.clientId) {
-      return true;
-    }
-
-    return false;
+  _matchActiveSingleCall: function _matchActiveSingleCall(aCall) {
+    return this._activeCall &&
+           this._activeCall instanceof SingleCall &&
+           this._activeCall.clientId === aCall.clientId &&
+           this._activeCall.callIndex === aCall.callIndex;
   },
 
   /**
@@ -179,17 +202,28 @@ TelephonyProvider.prototype = {
   _updateCallAudioState: function _updateCallAudioState(aCall,
                                                         aConferenceState) {
     if (aConferenceState === nsITelephonyProvider.CALL_STATE_CONNECTED) {
+      this._activeCall = new ConferenceCall(aConferenceState);
       gAudioManager.phoneState = nsIAudioManager.PHONE_STATE_IN_CALL;
       if (this.speakerEnabled) {
         gAudioManager.setForceForUse(nsIAudioManager.USE_COMMUNICATION,
                                      nsIAudioManager.FORCE_SPEAKER);
       }
+      if (DEBUG) {
+        debug("Active call, put audio system into PHONE_STATE_IN_CALL: " +
+              gAudioManager.phoneState);
+      }
       return;
     }
+
     if (aConferenceState === nsITelephonyProvider.CALL_STATE_UNKNOWN ||
         aConferenceState === nsITelephonyProvider.CALL_STATE_HELD) {
-      if (!this._activeCall) {
+      if (this._activeCall instanceof ConferenceCall) {
+        this._activeCall = null;
         gAudioManager.phoneState = nsIAudioManager.PHONE_STATE_NORMAL;
+        if (DEBUG) {
+          debug("No active call, put audio system into PHONE_STATE_NORMAL: " +
+                gAudioManager.phoneState);
+        }
       }
       return;
     }
@@ -199,7 +233,7 @@ TelephonyProvider.prototype = {
     }
 
     if (aCall.isConference) {
-      if (this._matchActiveCall(aCall)) {
+      if (this._matchActiveSingleCall(aCall)) {
         this._activeCall = null;
       }
       return;
@@ -210,7 +244,7 @@ TelephonyProvider.prototype = {
       case nsITelephonyProvider.CALL_STATE_ALERTING:
       case nsITelephonyProvider.CALL_STATE_CONNECTED:
         aCall.isActive = true;
-        this._activeCall = aCall;
+        this._activeCall = new SingleCall(aCall);
         gAudioManager.phoneState = nsIAudioManager.PHONE_STATE_IN_CALL;
         if (this.speakerEnabled) {
           gAudioManager.setForceForUse(nsIAudioManager.USE_COMMUNICATION,
@@ -238,7 +272,7 @@ TelephonyProvider.prototype = {
       case nsITelephonyProvider.CALL_STATE_HELD: // Fall through...
       case nsITelephonyProvider.CALL_STATE_DISCONNECTED:
         aCall.isActive = false;
-        if (this._matchActiveCall(aCall)) {
+        if (this._matchActiveSingleCall(aCall)) {
           // Previously active call is not active now.
           this._activeCall = null;
         }
@@ -355,7 +389,7 @@ TelephonyProvider.prototype = {
       for (let call of response.calls) {
         call.clientId = aClientId;
         call.state = this._convertRILCallState(call.state);
-        call.isActive = this._matchActiveCall(call);
+        call.isActive = this._matchActiveSingleCall(call);
 
         aListener.enumerateCallState(call.clientId, call.callIndex,
                                      call.state, call.number,
@@ -494,6 +528,7 @@ TelephonyProvider.prototype = {
     };
     gSystemMessenger.broadcastMessage("telephony-call-ended", data);
 
+    aCall.clientId = aClientId;
     this._updateCallAudioState(aCall, null);
 
     if (!aCall.failCause ||
@@ -545,6 +580,7 @@ TelephonyProvider.prototype = {
       gSystemMessenger.broadcastMessage("telephony-new-call", {});
     }
 
+    aCall.clientId = aClientId;
     this._updateCallAudioState(aCall, null);
 
     this._notifyAllListeners("callStateChanged", [aClientId,

From bde24c59044d7736e85370296feb9b96be7b2543 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 16:18:15 +0800
Subject: [PATCH 092/144] Bug 944262 - part2 - test cases. r=htsai

---
 dom/telephony/test/marionette/manifest.ini    |   1 +
 .../test_audiomanager_phonestate.js           | 265 ++++++++++++++++++
 2 files changed, 266 insertions(+)
 create mode 100644 dom/telephony/test/marionette/test_audiomanager_phonestate.js

diff --git a/dom/telephony/test/marionette/manifest.ini b/dom/telephony/test/marionette/manifest.ini
index 6725296d2c94..32e26394576b 100644
--- a/dom/telephony/test/marionette/manifest.ini
+++ b/dom/telephony/test/marionette/manifest.ini
@@ -46,3 +46,4 @@ disabled = Bug 821958
 [test_dsds_default_service_id.js]
 [test_call_mute.js]
 [test_dsds_normal_call.js]
+[test_audiomanager_phonestate.js]
diff --git a/dom/telephony/test/marionette/test_audiomanager_phonestate.js b/dom/telephony/test/marionette/test_audiomanager_phonestate.js
new file mode 100644
index 000000000000..f19ff1c25eaa
--- /dev/null
+++ b/dom/telephony/test/marionette/test_audiomanager_phonestate.js
@@ -0,0 +1,265 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+const AUDIO_MANAGER_CONTRACT_ID = "@mozilla.org/telephony/audiomanager;1";
+
+// See nsIAudioManager
+const PHONE_STATE_INVALID          = -2;
+const PHONE_STATE_CURRENT          = -1;
+const PHONE_STATE_NORMAL           = 0;
+const PHONE_STATE_RINGTONE         = 1;
+const PHONE_STATE_IN_CALL          = 2;
+const PHONE_STATE_IN_COMMUNICATION = 3;
+
+let conference;
+
+function checkTelephonyActiveAndCalls(active, calls) {
+  is(telephony.active, active, "telephony.active");
+  is(telephony.calls.length, calls.length, "telephony.calls");
+  for (let i = 0; i < calls.length; ++i) {
+    is(telephony.calls[i], calls[i]);
+  }
+}
+
+function checkConferenceStateAndCalls(state, calls) {
+  is(conference.state, state, "conference.state");
+  is(conference.calls.length, calls.length, "conference.calls");
+  for (let i = 0; i < calls.length; i++) {
+    is(conference.calls[i], calls[i]);
+  }
+}
+
+function checkInitialState() {
+  log("Verify initial state.");
+  ok(telephony.calls, 'telephony.call');
+  checkTelephonyActiveAndCalls(null, []);
+  ok(conference.calls, 'conference.calls');
+  checkConferenceStateAndCalls('', []);
+}
+
+function checkEventCallState(event, call, state) {
+  is(call, event.call, "event.call");
+  is(call.state, state, "call state");
+}
+
+function dial(number) {
+  log("Make an outgoing call: " + number);
+
+  let deferred = Promise.defer();
+  let call = telephony.dial(number);
+
+  ok(call);
+  is(call.number, number);
+  is(call.state, "dialing");
+
+  call.onalerting = function onalerting(event) {
+    call.onalerting = null;
+    log("Received 'onalerting' call event.");
+    checkEventCallState(event, call, "alerting");
+    deferred.resolve(call);
+  };
+
+  return deferred.promise;
+}
+
+function answer(call) {
+  log("Answering the incoming call.");
+
+  let deferred = Promise.defer();
+
+  call.onconnecting = function onconnectingIn(event) {
+    log("Received 'connecting' call event for incoming call.");
+    call.onconnecting = null;
+    checkEventCallState(event, call, "connecting");
+  };
+
+  call.onconnected = function onconnectedIn(event) {
+    log("Received 'connected' call event for incoming call.");
+    call.onconnected = null;
+    checkEventCallState(event, call, "connected");
+    ok(!call.onconnecting);
+    deferred.resolve(call);
+  };
+  call.answer();
+
+  return deferred.promise;
+}
+
+function remoteDial(number) {
+  log("Simulating an incoming call.");
+
+  let deferred = Promise.defer();
+
+  telephony.onincoming = function onincoming(event) {
+    log("Received 'incoming' call event.");
+    telephony.onimcoming = null;
+
+    let call = event.call;
+
+    ok(call);
+    is(call.number, number);
+    is(call.state, "incoming");
+
+    deferred.resolve(call);
+  };
+  emulator.run("gsm call " + number);
+
+  return deferred.promise;
+}
+
+function remoteAnswer(call) {
+  log("Remote answering the call.");
+
+  let deferred = Promise.defer();
+
+  call.onconnected = function onconnected(event) {
+    log("Received 'connected' call event.");
+    call.onconnected = null;
+    checkEventCallState(event, call, "connected");
+    deferred.resolve(call);
+  };
+  emulator.run("gsm accept " + call.number);
+
+  return deferred.promise;
+}
+
+function remoteHangUp(call) {
+  log("Remote hanging up the call.");
+
+  let deferred = Promise.defer();
+
+  call.ondisconnected = function ondisconnected(event) {
+    log("Received 'disconnected' call event.");
+    call.ondisconnected = null;
+    checkEventCallState(event, call, "disconnected");
+    deferred.resolve(call);
+  };
+  emulator.run("gsm cancel " + call.number);
+
+  return deferred.promise;
+}
+
+function remoteHangUpCalls(calls) {
+  let promise = Promise.resolve();
+
+  for (let call of calls) {
+    promise = promise.then(remoteHangUp.bind(null, call));
+  }
+
+  return promise;
+}
+
+// The length of callsToAdd should be 2.
+function addCallsToConference(callsToAdd) {
+  log("Add " + callsToAdd.length + " calls into conference.");
+
+  let deferred = Promise.defer();
+
+  conference.onconnected = function() {
+    deferred.resolve();
+  };
+
+  conference.add(callsToAdd[0], callsToAdd[1]);
+
+  return deferred.promise;
+}
+
+let audioManager;
+function checkStates(speakerEnabled, phoneState) {
+  if (!audioManager) {
+    audioManager = SpecialPowers.Cc[AUDIO_MANAGER_CONTRACT_ID]
+                                .getService(SpecialPowers.Ci.nsIAudioManager);
+    ok(audioManager, "nsIAudioManager instance");
+  }
+
+  is(telephony.speakerEnabled, speakerEnabled, "telephony.speakerEnabled");
+  if (phoneState == PHONE_STATE_CURRENT) {
+    ok(audioManager.phoneState === PHONE_STATE_CURRENT ||
+       audioManager.phoneState === PHONE_STATE_NORMAL, "audioManager.phoneState");
+  } else {
+    is(audioManager.phoneState, phoneState, "audioManager.phoneState");
+  }
+}
+
+function check(phoneStateOrig, phoneStateEnabled, phoneStateDisabled) {
+  checkStates(false, phoneStateOrig);
+
+  let canEnableSpeaker = arguments.length > 1;
+  telephony.speakerEnabled = true;
+  if (canEnableSpeaker) {
+    checkStates(true, phoneStateEnabled);
+  } else {
+    checkStates(false, phoneStateOrig);
+    return;
+  }
+
+  telephony.speakerEnabled = false;
+  checkStates(false, arguments.length > 2 ? phoneStateDisabled : phoneStateOrig);
+}
+
+// Start the test
+startTest(function() {
+  conference = telephony.conferenceGroup;
+  ok(conference);
+
+  let outNumber = "5555550101";
+  let inNumber  = "5555550201";
+  let outCall;
+  let inCall;
+
+  Promise.resolve()
+    .then(checkInitialState)
+    .then(() => check(PHONE_STATE_CURRENT, PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // Dial in
+    .then(() => remoteDial(inNumber))
+    .then(call => { inCall = call; })
+    // TODO - Bug 948860: should this be {RINGTONE, RINGTONE, RINGTONE}?
+    // From current UX spec, there is no chance that an user may enable speaker
+    // during alerting, so basically this 'set speaker enable' action can't
+    // happen in B2G.
+    .then(() => check(PHONE_STATE_RINGTONE, PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+    .then(() => answer(inCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Hang up all
+    .then(() => remoteHangUp(inCall))
+    .then(() => check(PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // Dial out
+    .then(() => dial(outNumber))
+    .then(call => { outCall = call; })
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    .then(() => remoteAnswer(outCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Hang up all
+    .then(() => remoteHangUp(outCall))
+    .then(() => check(PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // Dial out
+    .then(() => dial(outNumber))
+    .then(call => { outCall = call; })
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    .then(() => remoteAnswer(outCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Dial out and dial in
+    .then(() => remoteDial(inNumber))
+    .then(call => { inCall = call; })
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    .then(() => answer(inCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Conference
+    .then(() => addCallsToConference([outCall, inCall]))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Hang up all
+    .then(() => remoteHangUpCalls([outCall, inCall]))
+    .then(() => check(PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // End
+    .then(null, error => {
+      ok(false, 'promise rejects during test.');
+    })
+    .then(finish);
+});

From 2e1b88e2ff86fd4c782cfb3850df689b2c21cddf Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 00:20:26 -0800
Subject: [PATCH 093/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/e091dab8b696
Author: George <georgeiscoming@gmail.com>
Desc: Merge pull request #13118 from cctuan/928254-2

Bug 928254 - [Flatfish][Gallery] support 2 column layout for tablet

========

https://hg.mozilla.org/integration/gaia-central/rev/10d972474dd9
Author: cctuan <georgeiscoming@gmail.com>
Desc: Bug 928254 - [Flatfish][Gallery] support 2 column layout for tablet
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 7bb9803eccd4..3ed6f51e22a2 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "c5fa2dc97777833bc1e69862cec075ca4bfa35e0", 
+    "revision": "e091dab8b696418c4b3fc01f45484e264450bbf4", 
     "repo_path": "/integration/gaia-central"
 }

From 003ce7f7b276271763902c140493f762bff51b4e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 00:35:23 -0800
Subject: [PATCH 094/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/e520ec1919d3
Author: John Hu <johu@mozilla.com>
Desc: Merge pull request #13340 from huchengtw-moz/video/Bug_903920_flatfish_ui

Bug 903920 - [Flatfish][Video] support 2 column layout for tablet, r=cctuan

========

https://hg.mozilla.org/integration/gaia-central/rev/35e06ab2ebf3
Author: John Hu <johu@mozilla.com>
Desc: Bug 903920 - [Flatfish][Video] support 2 column layout for tablet
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3ed6f51e22a2..f06eddc5cf23 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "e091dab8b696418c4b3fc01f45484e264450bbf4", 
+    "revision": "e520ec1919d3794830fa72e506b68c4098a8a551", 
     "repo_path": "/integration/gaia-central"
 }

From 750d1b3f99f63aef04772f203e2b54f5d3ae7ac0 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 00:45:24 -0800
Subject: [PATCH 095/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/58da665437f2
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Merge pull request #14579 from jaoo/933203

Bug 933203 - [DSDS] Operator variant logic: APN settings. r=kaze

========

https://hg.mozilla.org/integration/gaia-central/rev/5f437cda7db3
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Bug 933203 - [DSDS] Operator variant logic: APN settings
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index f06eddc5cf23..872c62446213 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "e520ec1919d3794830fa72e506b68c4098a8a551", 
+    "revision": "58da665437f25f577446b62e4e5b9f6749236911", 
     "repo_path": "/integration/gaia-central"
 }

From 032b73144e0e2d7b114777f05890d8605f1aba85 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 01:00:24 -0800
Subject: [PATCH 096/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/4ee9d0390649
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14632 from alivedise/bugzilla/948596_v2/activity-window-size-copy

Bug 948596 - fullscreen state of activity window, r=timdream

========

https://hg.mozilla.org/integration/gaia-central/rev/767ecb92b6e8
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 948596 - fullscreen state of activity window
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 872c62446213..8f68e4c3de5b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "58da665437f25f577446b62e4e5b9f6749236911", 
+    "revision": "4ee9d03906496a552897cf2688467ca5217f0542", 
     "repo_path": "/integration/gaia-central"
 }

From 2119e194392837e0dafe3a47098bc5bcdbfc3e11 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 01:20:25 -0800
Subject: [PATCH 097/144] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/e402acba87cf
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14636 from alivedise/bugzilla/949950/typo-gaia-apps

Bug 949950 - fix src in gaia-apps, r=davehunt

========

https://hg.mozilla.org/integration/gaia-central/rev/f397343db001
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 949950 - fix src in gaia-apps

========

https://hg.mozilla.org/integration/gaia-central/rev/4e4fbe820dd0
Author: Arnau <arnau@arnaumarch.com>
Desc: Merge pull request #14497 from rnowm/FB-header

Bug 946775 - [contacts][facebook] When importing contacts, blue facebook...

========

https://hg.mozilla.org/integration/gaia-central/rev/3a8d41c1364c
Author: rnowm <arnau@arnaumarch.com>
Desc: Bug 946775 - [contacts][facebook] When importing contacts, blue facebook header has wrong tapped color

and close icon
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 8f68e4c3de5b..3368e684aa23 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "4ee9d03906496a552897cf2688467ca5217f0542", 
+    "revision": "e402acba87cf7ff74fd7c5a1ea7ea0563c217b9c", 
     "repo_path": "/integration/gaia-central"
 }

From bf4d2a69a42b9e50ccbd5557ed81ec62cdd88a51 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 01:50:24 -0800
Subject: [PATCH 098/144] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/57da16cd5729
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Merge pull request #14489 from jaoo/928297

Bug 928297 - [DSDS][Gaia] Settings app should support cellular & data settings of multiple sim cards. r=arthurcc

========

https://hg.mozilla.org/integration/gaia-central/rev/8e4914b0263a
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Bug 928297 - [DSDS][Gaia] Settings app should support cellular & data settings of multiple sim cards

========

https://hg.mozilla.org/integration/gaia-central/rev/ec760f98e960
Author: Greg Weng <snowmantw@gmail.com>
Desc: Merge pull request #14631 from snowmantw/issue949904

Bug 949904 - [LockScreen] When tap on the handle after dragged once, it sliding irregular toward the same side

========

https://hg.mozilla.org/integration/gaia-central/rev/8a7e8953b4bc
Author: Greg Weng (snowmantw) <gweng@mozilla.com>
Desc: Bug 949904 - [LockScreen] When tap on the handle after dragged once, it sliding irregular toward the same side
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3368e684aa23..aa161fb26e87 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "e402acba87cf7ff74fd7c5a1ea7ea0563c217b9c", 
+    "revision": "57da16cd5729afab09c4b1b1305be2625f449e88", 
     "repo_path": "/integration/gaia-central"
 }

From b40ca70a51acbab1eacecc7441e8b1199203c330 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 02:00:24 -0800
Subject: [PATCH 099/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/64a86fa375e9
Author: Etienne Segonzac <etienne@segonzac.info>
Desc: Merge pull request #14546 from karlt/943138

bug 943138 - improve dialer ADSR envelope r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/c8af3b692644
Author: Karl Tomlinson <karlt+@karlt.net>
Desc: bug 943138 - improve dialer ADSR envelope

Scheduling tones at AudioContext.currentTime resulted in the first part of the
tone being cut off, so start an AudioBufferSourceNode for the envelope.

Add a release phase for long dialer tones.

Revert the release period to 0.05 to match the prior mozWriteAudio
implementation.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index aa161fb26e87..a9df0add8881 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "57da16cd5729afab09c4b1b1305be2625f449e88", 
+    "revision": "64a86fa375e95d0aa60e96fb69c09d2c6089d2e8", 
     "repo_path": "/integration/gaia-central"
 }

From 64177168690d12223c5fc08aa33a24085f3ccd16 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 02:50:24 -0800
Subject: [PATCH 100/144] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/28714578feea
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14635 from alivedise/bugzilla/949527/wrapper-name

Bug 949527 - Modify wrapper name, r=timdream

========

https://hg.mozilla.org/integration/gaia-central/rev/21f5c547894e
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 949527 - Modify wrapper name

========

https://hg.mozilla.org/integration/gaia-central/rev/019e7137d362
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Merge pull request #14628 from timdream/splash-icon-size

Bug 904332 - Select the size of the icon in cold launch splash according to the spec, r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/150eab46b1a0
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Bug 904332 - Select the size of the icon in cold launch splash according to the spec
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index a9df0add8881..4af865b42e96 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "64a86fa375e95d0aa60e96fb69c09d2c6089d2e8", 
+    "revision": "28714578feeae99aa02527711279d07671120ebf", 
     "repo_path": "/integration/gaia-central"
 }

From 74fa88d0c4aef362841a478392964e03879ffc31 Mon Sep 17 00:00:00 2001
From: Patrick Wang <kk1fff@patrickz.net>
Date: Fri, 13 Dec 2013 16:38:08 +0800
Subject: [PATCH 101/144] Bug 948545: Nuwa process shouldn't exist if
 dom.ipc.processPrelaunch.enabled is false r=khuey

---
 dom/ipc/PreallocatedProcessManager.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/ipc/PreallocatedProcessManager.cpp b/dom/ipc/PreallocatedProcessManager.cpp
index 898663c004f8..11718afe5ac5 100644
--- a/dom/ipc/PreallocatedProcessManager.cpp
+++ b/dom/ipc/PreallocatedProcessManager.cpp
@@ -246,7 +246,7 @@ PreallocatedProcessManagerImpl::DelayedNuwaFork()
   mPreallocateAppProcessTask = nullptr;
 
   if (!mIsNuwaReady) {
-    if (!mPreallocatedAppProcess && !mShutdown) {
+    if (!mPreallocatedAppProcess && !mShutdown && mEnabled) {
       mPreallocatedAppProcess = ContentParent::RunNuwaProcess();
     }
     // else mPreallocatedAppProcess is starting. It will NuwaFork() when ready.

From 71e468b2a6be93d9723463830b2f6306aa40573e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:26 +0100
Subject: [PATCH 102/144] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 1: FxAccountsManager. r=markh

---
 services/fxaccounts/FxAccounts.jsm        |   9 +-
 services/fxaccounts/FxAccountsConsts.js   |  85 +++++
 services/fxaccounts/FxAccountsManager.jsm | 382 ++++++++++++++++++++++
 services/fxaccounts/moz.build             |   8 +-
 4 files changed, 475 insertions(+), 9 deletions(-)
 create mode 100644 services/fxaccounts/FxAccountsConsts.js
 create mode 100644 services/fxaccounts/FxAccountsManager.jsm

diff --git a/services/fxaccounts/FxAccounts.jsm b/services/fxaccounts/FxAccounts.jsm
index aa900cc49ace..c7efa8429b9b 100644
--- a/services/fxaccounts/FxAccounts.jsm
+++ b/services/fxaccounts/FxAccounts.jsm
@@ -16,18 +16,11 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Timer.jsm");
 Cu.import("resource://gre/modules/Task.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
+Cu.import("resource://gre/modules/FxAccountsConsts.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "jwcrypto",
                                   "resource://gre/modules/identity/jwcrypto.jsm");
 
-const DATA_FORMAT_VERSION = 1;
-const DEFAULT_STORAGE_FILENAME = "signedInUser.json";
-const ASSERTION_LIFETIME = 1000 * 60 * 5; // 5 minutes
-const KEY_LIFETIME = 1000 * 3600 * 12;    // 12 hours
-const CERT_LIFETIME = 1000 * 3600 * 6;    // 6 hours
-const POLL_SESSION = 1000 * 60 * 5;       // 5 minutes
-const POLL_STEP = 1000 * 3;               // 3 seconds
-
 // loglevel preference should be one of: "FATAL", "ERROR", "WARN", "INFO",
 // "CONFIG", "DEBUG", "TRACE" or "ALL". We will be logging error messages by
 // default.
diff --git a/services/fxaccounts/FxAccountsConsts.js b/services/fxaccounts/FxAccountsConsts.js
new file mode 100644
index 000000000000..51e8427b038a
--- /dev/null
+++ b/services/fxaccounts/FxAccountsConsts.js
@@ -0,0 +1,85 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+this.DATA_FORMAT_VERSION = 1;
+this.DEFAULT_STORAGE_FILENAME = "signedInUser.json";
+
+// Token life times.
+this.ASSERTION_LIFETIME = 1000 * 60 * 5;    // 5 minutes
+this.CERT_LIFETIME      = 1000 * 3600 * 6;  // 6 hours
+this.KEY_LIFETIME       = 1000 * 3600 * 12; // 12 hours
+
+// Polling timings.
+this.POLL_SESSION       = 1000 * 60 * 5;    // 5 minutes
+this.POLL_STEP          = 1000 * 3;         // 3 seconds
+
+// Server errno.
+// From https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#response-format
+this.ERRNO_ACCOUNT_ALREADY_EXISTS     = 101;
+this.ERRNO_ACCOUNT_DOES_NOT_EXISTS    = 102;
+this.ERRNO_INCORRECT_PASSWORD         = 103;
+this.ERRNO_UNVERIFIED_ACCOUNT         = 104;
+this.ERRNO_INVALID_VERIFICATION_CODE  = 105;
+this.ERRNO_NOT_VALID_JSON_BODY        = 106;
+this.ERRNO_INVALID_BODY_PARAMETERS    = 107;
+this.ERRNO_MISSING_BODY_PARAMETERS    = 108;
+this.ERRNO_INVALID_REQUEST_SIGNATURE  = 109;
+this.ERRNO_INVALID_AUTH_TOKEN         = 110;
+this.ERRNO_INVALID_AUTH_TIMESTAMP     = 111;
+this.ERRNO_MISSING_CONTENT_LENGTH     = 112;
+this.ERRNO_REQUEST_BODY_TOO_LARGE     = 113;
+this.ERRNO_TOO_MANY_CLIENT_REQUESTS   = 114;
+this.ERRNO_INVALID_AUTH_NONCE         = 115;
+this.ERRNO_SERVICE_TEMP_UNAVAILABLE   = 201;
+this.ERRNO_UNKNOWN_ERROR              = 999;
+
+// Errors.
+this.ERROR_ACCOUNT_ALREADY_EXISTS     = "ACCOUNT_ALREADY_EXISTS";
+this.ERROR_ACCOUNT_DOES_NOT_EXISTS    = "ACCOUNT_DOES_NOT_EXISTS";
+this.ERROR_ALREADY_SIGNED_IN_USER     = "ALREADY_SIGNED_IN_USER";
+this.ERROR_INVALID_ACCOUNTID          = "INVALID_ACCOUNTID";
+this.ERROR_INVALID_AUDIENCE           = "INVALID_AUDIENCE";
+this.ERROR_INVALID_AUTH_TOKEN         = "INVALID_AUTH_TOKEN";
+this.ERROR_INVALID_AUTH_TIMESTAMP     = "INVALID_AUTH_TIMESTAMP";
+this.ERROR_INVALID_AUTH_NONCE         = "INVALID_AUTH_NONCE";
+this.ERROR_INVALID_BODY_PARAMETERS    = "INVALID_BODY_PARAMETERS";
+this.ERROR_INVALID_PASSWORD           = "INVALID_PASSWORD";
+this.ERROR_INVALID_VERIFICATION_CODE  = "INVALID_VERIFICATION_CODE";
+this.ERROR_INVALID_REQUEST_SIGNATURE  = "INVALID_REQUEST_SIGNATURE";
+this.ERROR_INTERNAL_INVALID_USER      = "INTERNAL_ERROR_INVALID_USER";
+this.ERROR_MISSING_BODY_PARAMETERS    = "MISSING_BODY_PARAMETERS";
+this.ERROR_MISSING_CONTENT_LENGTH     = "MISSING_CONTENT_LENGTH";
+this.ERROR_NO_TOKEN_SESSION           = "NO_TOKEN_SESSION";
+this.ERROR_NOT_VALID_JSON_BODY        = "NOT_VALID_JSON_BODY";
+this.ERROR_OFFLINE                    = "OFFLINE";
+this.ERROR_REQUEST_BODY_TOO_LARGE     = "REQUEST_BODY_TOO_LARGE";
+this.ERROR_SERVER_ERROR               = "SERVER_ERROR";
+this.ERROR_TOO_MANY_CLIENT_REQUESTS   = "TOO_MANY_CLIENT_REQUESTS";
+this.ERROR_SERVICE_TEMP_UNAVAILABLE   = "SERVICE_TEMPORARY_UNAVAILABLE";
+this.ERROR_UI_ERROR                   = "UI_ERROR";
+this.ERROR_UNKNOWN                    = "UNKNOWN_ERROR";
+this.ERROR_UNVERIFIED_ACCOUNT         = "UNVERIFIED_ACCOUNT";
+
+// Error matching.
+this.SERVER_ERRNO_TO_ERROR = {};
+SERVER_ERRNO_TO_ERROR[ERRNO_ACCOUNT_ALREADY_EXISTS]     = ERROR_ACCOUNT_ALREADY_EXISTS;
+SERVER_ERRNO_TO_ERROR[ERRNO_ACCOUNT_DOES_NOT_EXISTS]    = ERROR_ACCOUNT_DOES_NOT_EXISTS;
+SERVER_ERRNO_TO_ERROR[ERRNO_INCORRECT_PASSWORD]         = ERROR_INVALID_PASSWORD;
+SERVER_ERRNO_TO_ERROR[ERRNO_UNVERIFIED_ACCOUNT]         = ERROR_UNVERIFIED_ACCOUNT;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_VERIFICATION_CODE]  = ERROR_INVALID_VERIFICATION_CODE;
+SERVER_ERRNO_TO_ERROR[ERRNO_NOT_VALID_JSON_BODY]        = ERROR_NOT_VALID_JSON_BODY;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_BODY_PARAMETERS]    = ERROR_INVALID_BODY_PARAMETERS;
+SERVER_ERRNO_TO_ERROR[ERRNO_MISSING_BODY_PARAMETERS]    = ERROR_MISSING_BODY_PARAMETERS;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_REQUEST_SIGNATURE]  = ERROR_INVALID_REQUEST_SIGNATURE;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_AUTH_TOKEN]         = ERROR_INVALID_AUTH_TOKEN;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_AUTH_TIMESTAMP]     = ERROR_INVALID_AUTH_TIMESTAMP;
+SERVER_ERRNO_TO_ERROR[ERRNO_MISSING_CONTENT_LENGTH]     = ERROR_MISSING_CONTENT_LENGTH;
+SERVER_ERRNO_TO_ERROR[ERRNO_REQUEST_BODY_TOO_LARGE]     = ERROR_REQUEST_BODY_TOO_LARGE;
+SERVER_ERRNO_TO_ERROR[ERRNO_TOO_MANY_CLIENT_REQUESTS]   = ERROR_TOO_MANY_CLIENT_REQUESTS;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_AUTH_NONCE]         = ERROR_INVALID_AUTH_NONCE;
+SERVER_ERRNO_TO_ERROR[ERRNO_SERVICE_TEMP_UNAVAILABLE]   = ERROR_SERVICE_TEMP_UNAVAILABLE;
+SERVER_ERRNO_TO_ERROR[ERRNO_UNKNOWN_ERROR]              = ERROR_UNKNOWN;
+
+// Allow this file to be imported via Components.utils.import().
+this.EXPORTED_SYMBOLS = Object.keys(this);
diff --git a/services/fxaccounts/FxAccountsManager.jsm b/services/fxaccounts/FxAccountsManager.jsm
new file mode 100644
index 000000000000..ea45c30cbb8b
--- /dev/null
+++ b/services/fxaccounts/FxAccountsManager.jsm
@@ -0,0 +1,382 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Temporary abstraction layer for common Fx Accounts operations.
+ * For now, we will be using this module only from B2G but in the end we might
+ * want this to be merged with FxAccounts.jsm and let other products also use
+ * it.
+ */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["FxAccountsManager"];
+
+const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/FxAccounts.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/FxAccountsConsts.js");
+
+XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsClient",
+  "resource://gre/modules/FxAccountsClient.jsm");
+
+this.FxAccountsManager = {
+
+  // We don't really need to save fxAccounts instance but this way we allow
+  // to mock FxAccounts from tests.
+  _fxAccounts: fxAccounts,
+
+  // We keep the session details here so consumers don't need to deal with
+  // session tokens and are only required to handle the email.
+  _activeSession: null,
+
+  // We only expose the email and the verified status so far.
+  get _user() {
+    if (!this._activeSession || !this._activeSession.email) {
+      return null;
+    }
+
+    return {
+      accountId: this._activeSession.email,
+      verified: this._activeSession.verified
+    }
+  },
+
+  _getError: function(aServerResponse) {
+    if (!aServerResponse || !aServerResponse.error || !aServerResponse.error.errno) {
+      return;
+    }
+    return SERVER_ERRNO_TO_ERROR[aServerResponse.error.errno];
+  },
+
+  _serverError: function(aServerResponse) {
+    let error = this._getError({ error: aServerResponse });
+    return Promise.reject({
+      error: error ? error : ERROR_SERVER_ERROR,
+      details: aServerResponse
+    });
+  },
+
+  // As we do with _fxAccounts, we don't really need this factory, but this way
+  // we allow tests to mock FxAccountsClient.
+  _createFxAccountsClient: function() {
+    return new FxAccountsClient();
+  },
+
+  _signInSignUp: function(aMethod, aAccountId, aPassword) {
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    if (!aAccountId) {
+      return Promise.reject({
+        error: ERROR_INVALID_ACCOUNTID
+      });
+    }
+
+    if (!aPassword) {
+      return Promise.reject({
+        error: ERROR_INVALID_PASSWORD
+      });
+    }
+
+    // Check that there is no signed in account first.
+    if (this._activeSession) {
+      return Promise.reject({
+        error: ERROR_ALREADY_SIGNED_IN_USER,
+        details: {
+          user: this._user
+        }
+      });
+    }
+
+    let client = this._createFxAccountsClient();
+    return this._fxAccounts.getSignedInUser().then(
+      user => {
+        if (user) {
+          return Promise.reject({
+            error: ERROR_ALREADY_SIGNED_IN_USER,
+            details: {
+              user: user
+            }
+          });
+        }
+        return client[aMethod](aAccountId, aPassword);
+      }
+    ).then(
+      user => {
+        let error = this._getError(user);
+        if (!user || !user.uid || !user.sessionToken || error) {
+          return Promise.reject({
+            error: error ? error : ERROR_INTERNAL_INVALID_USER,
+            details: {
+              user: user
+            }
+          });
+        }
+
+        // Save the credentials of the signed in user.
+        user.email = aAccountId;
+        return this._fxAccounts.setSignedInUser(user, false).then(
+          () => {
+            this._activeSession = user;
+            return Promise.resolve({
+              accountCreated: aMethod === "signUp",
+              user: this._user
+            });
+          }
+        );
+      },
+      reason => { return this._serverError(reason); }
+    );
+  },
+
+  _getAssertion: function(aAudience) {
+    return this._fxAccounts.getAssertion(aAudience);
+  },
+
+  _signOut: function() {
+    if (!this._activeSession) {
+      return Promise.resolve();
+    }
+
+    return this._fxAccounts.signOut(this._activeSession.sessionToken).then(
+      () => {
+        // If there is no connection, removing the local session should be
+        // enough. The client can create new sessions up to the limit (100?).
+        // Orphaned tokens on the server will eventually be garbage collected.
+        if (Services.io.offline) {
+          this._activeSession = null;
+          return Promise.resolve();
+        }
+        // Otherwise, we try to remove the remote session.
+        let client = this._createFxAccountsClient();
+        return client.signOut(this._activeSession.sessionToken).then(
+          result => {
+            // Even if there is a remote server error, we remove the local
+            // session.
+            this._activeSession = null;
+            let error = this._getError(result);
+            if (error) {
+              return Promise.reject({
+                error: error,
+                details: result
+              });
+            }
+            return Promise.resolve();
+          },
+          reason => {
+            // Even if there is a remote server error, we remove the local
+            // session.
+            this._activeSession = null;
+            return this._serverError(reason);
+          }
+        );
+      }
+    );
+  },
+
+  // -- API --
+
+  signIn: function(aAccountId, aPassword) {
+    return this._signInSignUp("signIn", aAccountId, aPassword);
+  },
+
+  signUp: function(aAccountId, aPassword) {
+    return this._signInSignUp("signUp", aAccountId, aPassword);
+  },
+
+  signOut: function() {
+    if (!this._activeSession) {
+      // If there is no cached active session, we try to get it from the
+      // account storage.
+      return this.getAccount().then(
+        result => {
+          if (!result) {
+            return Promise.resolve();
+          }
+          return this._signOut();
+        }
+      );
+    }
+    return this._signOut();
+  },
+
+  getAccount: function() {
+    // We check first if we have session details cached.
+    if (this._activeSession) {
+      // If our cache says that the account is not yet verified, we check that
+      // this information is correct, and update the cached data if not.
+      if (this._activeSession && !this._activeSession.verified &&
+          !Services.io.offline) {
+        return this.verificationStatus(this._activeSession);
+      }
+
+      return Promise.resolve(this._user);
+    }
+
+    // If no cached information, we try to get it from the persistent storage.
+    return this._fxAccounts.getSignedInUser().then(
+      user => {
+        if (!user || !user.email) {
+          return Promise.resolve(null);
+        }
+
+        this._activeSession = user;
+        // If we get a stored information of a not yet verified account,
+        // we check this information with the server, update the stored
+        // data if needed and finally return the account details.
+        if (!user.verified && !Services.io.offline) {
+          return this.verificationStatus(user);
+        }
+
+        return Promise.resolve(this._user);
+      }
+    );
+  },
+
+  queryAccount: function(aAccountId) {
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    let deferred = Promise.defer();
+
+    if (!aAccountId) {
+      return Promise.reject({
+        error: ERROR_INVALID_ACCOUNTID
+      });
+    }
+
+    let client = this._createFxAccountsClient();
+    return client.accountExists(aAccountId).then(
+      result => {
+        let error = this._getError(result);
+        if (error) {
+          return Promise.reject({
+            error: error,
+            details: result
+          });
+        }
+
+        return Promise.resolve({
+          registered: result
+        });
+      },
+      reason => { this._serverError(reason); }
+    );
+  },
+
+  verificationStatus: function() {
+    if (!this._activeSession || !this._activeSession.sessionToken) {
+      return Promise.reject({
+        error: ERROR_NO_TOKEN_SESSION
+      });
+    }
+
+    // There is no way to unverify an already verified account, so we just
+    // return the account details of a verified account
+    if (this._activeSession.verified) {
+      return Promise.resolve(this._user);
+    }
+
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    let client = this._createFxAccountsClient();
+    return client.recoveryEmailStatus(this._activeSession.sessionToken).then(
+      data => {
+        let error = this._getError(data);
+        if (error) {
+          return Promise.reject({
+            error: error,
+            details: data
+          });
+        }
+
+        // If the verification status is different from the one that we have
+        // stored, we update it and return the session data. If not, we simply
+        // return the session data.
+        if (this._activeSession.verified != data.verified) {
+          this._activeSession.verified = data.verified;
+          return this._fxAccounts.setSignedInUser(this._activeSession).then(
+            () => {
+              return Promise.resolve(this._user);
+            }
+          );
+        }
+        return Promise.resolve(this._user);
+      },
+      reason => { return this._serverError(reason); }
+    );
+  },
+
+  getAssertion: function(aAudience) {
+    if (!aAudience) {
+      return Promise.reject({
+        error: ERROR_INVALID_AUDIENCE
+      });
+    }
+
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    return this.getAccount().then(
+      user => {
+        if (user) {
+          // We cannot get assertions for unverified accounts.
+          if (user.verified) {
+            return this._getAssertion(aAudience);
+          }
+
+          return Promise.reject({
+            error: ERROR_UNVERIFIED_ACCOUNT,
+            details: {
+              user: user
+            }
+          });
+        }
+
+        // If there is no currently signed in user, we trigger the signIn UI
+        // flow.
+        let ui = Cc["@mozilla.org/fxaccounts/fxaccounts-ui-glue;1"]
+                   .createInstance(Ci.nsIFxAccountsUIGlue);
+        return ui.signInFlow().then(
+          result => {
+            // Even if we get a successful result from the UI, the account will
+            // most likely be unverified, so we cannot get an assertion.
+            if (result && result.verified) {
+              return this._getAssertion(aAudience);
+            }
+            return Promise.reject({
+              error: ERROR_UNVERIFIED_ACCOUNT,
+              details: {
+                user: result
+              }
+            });
+          },
+          error => {
+            return Promise.reject({
+              error: ERROR_UI_ERROR,
+              details: error
+            });
+          }
+        );
+      }
+    );
+  }
+};
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 0f9e7e3ff30a..98741dfd2926 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -5,7 +5,13 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 TEST_DIRS += ['tests']
+
 EXTRA_JS_MODULES += [
   'FxAccounts.jsm',
-  'FxAccountsClient.jsm'
+  'FxAccountsClient.jsm',
+  'FxAccountsConsts.js'
 ]
+
+# For now, we will only be using the FxA manager in B2G.
+if CONFIG['MOZ_B2G']:
+  EXTRA_JS_MODULES += ['FxAccountsManager.jsm']

From e0fba846892b61e21d89c7c7df8a2f995e23cac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:26 +0100
Subject: [PATCH 103/144] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 2: UI Glue r=fabrice

---
 b2g/components/B2GComponents.manifest         |  4 ++
 b2g/components/FxAccountsUIGlue.js            | 68 +++++++++++++++++++
 b2g/components/moz.build                      |  1 +
 b2g/installer/package-manifest.in             |  3 +
 services/fxaccounts/interfaces/moz.build      | 11 +++
 .../interfaces/nsIFxAccountsUIGlue.idl        | 12 ++++
 services/fxaccounts/moz.build                 |  2 +
 7 files changed, 101 insertions(+)
 create mode 100644 b2g/components/FxAccountsUIGlue.js
 create mode 100644 services/fxaccounts/interfaces/moz.build
 create mode 100644 services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl

diff --git a/b2g/components/B2GComponents.manifest b/b2g/components/B2GComponents.manifest
index 628aad91dd61..0ebcc8cfdf92 100644
--- a/b2g/components/B2GComponents.manifest
+++ b/b2g/components/B2GComponents.manifest
@@ -72,6 +72,10 @@ component {637b0f77-2429-49a0-915f-abf5d0db8b9a} WebappsUpdateTimer.js
 contract @mozilla.org/b2g/webapps-update-timer;1 {637b0f77-2429-49a0-915f-abf5d0db8b9a}
 category update-timer WebappsUpdateTimer @mozilla.org/b2g/webapps-update-timer;1,getService,background-update-timer,webapps.update.interval,86400
 
+# FxAccountsUIGlue.js
+component {51875c14-91d7-4b8c-b65d-3549e101228c} FxAccountsUIGlue.js
+contract @mozilla.org/fxaccounts/fxaccounts-ui-glue;1 {51875c14-91d7-4b8c-b65d-3549e101228c}
+
 # HelperAppDialog.js
 component {710322af-e6ae-4b0c-b2c9-1474a87b077e} HelperAppDialog.js
 contract @mozilla.org/helperapplauncherdialog;1 {710322af-e6ae-4b0c-b2c9-1474a87b077e}
diff --git a/b2g/components/FxAccountsUIGlue.js b/b2g/components/FxAccountsUIGlue.js
new file mode 100644
index 000000000000..a2650237cc90
--- /dev/null
+++ b/b2g/components/FxAccountsUIGlue.js
@@ -0,0 +1,68 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict"
+
+const { interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+XPCOMUtils.defineLazyServiceGetter(this, "uuidgen",
+                                   "@mozilla.org/uuid-generator;1",
+                                   "nsIUUIDGenerator");
+
+function FxAccountsUIGlue() {
+}
+
+FxAccountsUIGlue.prototype = {
+
+  _browser: Services.wm.getMostRecentWindow("navigator:browser"),
+
+  signInFlow: function() {
+    let deferred = Promise.defer();
+
+    let content = this._browser.getContentWindow();
+    if (!content) {
+      deferred.reject("InternalErrorNoContent");
+      return;
+    }
+
+    let id = uuidgen.generateUUID().toString();
+
+    content.addEventListener("mozFxAccountsRPContentEvent",
+                             function onContentEvent(result) {
+      let msg = result.detail;
+      if (!msg || !msg.id || msg.id != id) {
+        deferred.reject("InternalErrorWrongContentEvent");
+        content.removeEventListener("mozFxAccountsRPContentEvent",
+                                    onContentEvent);
+        return;
+      }
+
+      if (msg.error) {
+        deferred.reject(msg);
+      } else {
+        deferred.resolve(msg.result);
+      }
+      content.removeEventListener("mozFxAccountsRPContentEvent",
+                                  onContentEvent);
+    });
+
+    this._browser.shell.sendCustomEvent("mozFxAccountsRPChromeEvent", {
+      method: "openFlow",
+      id: id
+    });
+
+    return deferred.promise;
+  },
+
+  classID: Components.ID("{51875c14-91d7-4b8c-b65d-3549e101228c}"),
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIFxAccountsUIGlue])
+};
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([FxAccountsUIGlue]);
diff --git a/b2g/components/moz.build b/b2g/components/moz.build
index a0ed6421f002..c5b6bb1dc2e1 100644
--- a/b2g/components/moz.build
+++ b/b2g/components/moz.build
@@ -13,6 +13,7 @@ EXTRA_COMPONENTS += [
     'ContentHandler.js',
     'ContentPermissionPrompt.js',
     'FilePicker.js',
+    'FxAccountsUIGlue.js',
     'HelperAppDialog.js',
     'MailtoProtocolHandler.js',
     'PaymentGlue.js',
diff --git a/b2g/installer/package-manifest.in b/b2g/installer/package-manifest.in
index eb92d18f522c..23243a990137 100644
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -789,6 +789,7 @@ bin/components/@DLL_PREFIX@nkgnomevfs@DLL_SUFFIX@
 @BINPATH@/components/TelProtocolHandler.js
 @BINPATH@/components/B2GAboutRedirector.js
 @BINPATH@/components/FilePicker.js
+@BINPATH@/components/FxAccountsUIGlue.js
 @BINPATH@/components/HelperAppDialog.js
 @BINPATH@/components/DownloadsUI.js
 
@@ -796,6 +797,8 @@ bin/components/@DLL_PREFIX@nkgnomevfs@DLL_SUFFIX@
 @BINPATH@/components/DataStoreService.js
 @BINPATH@/components/dom_datastore.xpt
 
+@BINPATH@/components/services_fxaccounts.xpt
+
 #ifdef MOZ_WEBSPEECH
 @BINPATH@/components/dom_webspeechsynth.xpt
 #endif
diff --git a/services/fxaccounts/interfaces/moz.build b/services/fxaccounts/interfaces/moz.build
new file mode 100644
index 000000000000..3dcb3b997b25
--- /dev/null
+++ b/services/fxaccounts/interfaces/moz.build
@@ -0,0 +1,11 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPIDL_SOURCES += [
+    'nsIFxAccountsUIGlue.idl'
+]
+
+XPIDL_MODULE = 'services_fxaccounts'
diff --git a/services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl b/services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl
new file mode 100644
index 000000000000..10adbc764cfa
--- /dev/null
+++ b/services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl
@@ -0,0 +1,12 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+[scriptable, uuid(5805ac8b-7cbe-4fbd-97ad-d3ae8cd29f79)]
+interface nsIFxAccountsUIGlue : nsISupports
+{
+  // Returns a Promise.
+  jsval signInFlow();
+};
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 98741dfd2926..060361da2e73 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+PARALLEL_DIRS += ['interfaces']
+
 TEST_DIRS += ['tests']
 
 EXTRA_JS_MODULES += [

From 712d24a0911a5308adb401ba5989f6e1559c9985 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:26 +0100
Subject: [PATCH 104/144] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 3: FxA B2G Service. r=fabrice

---
 b2g/chrome/content/shell.js              |   5 +-
 b2g/components/FxAccountsMgmtService.jsm | 127 +++++++++++++++++++++++
 b2g/components/moz.build                 |   1 +
 3 files changed, 132 insertions(+), 1 deletion(-)
 create mode 100644 b2g/components/FxAccountsMgmtService.jsm

diff --git a/b2g/chrome/content/shell.js b/b2g/chrome/content/shell.js
index eb920e0fd7fc..bfc29487f356 100644
--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -21,9 +21,10 @@ Cu.import('resource://gre/modules/ErrorPage.jsm');
 Cu.import('resource://gre/modules/NetworkStatsService.jsm');
 #endif
 
-// identity
+// Identity
 Cu.import('resource://gre/modules/SignInToWebsite.jsm');
 SignInToWebsiteController.init();
+Cu.import('resource://gre/modules/FxAccountsMgmtService.jsm');
 
 Cu.import('resource://gre/modules/DownloadsAPI.jsm');
 
@@ -614,6 +615,8 @@ var shell = {
 
     this.sendEvent(window, 'ContentStart');
 
+    Services.obs.notifyObservers(null, 'content-start', null);
+
 #ifdef MOZ_WIDGET_GONK
     Cu.import('resource://gre/modules/OperatorApps.jsm');
 #endif
diff --git a/b2g/components/FxAccountsMgmtService.jsm b/b2g/components/FxAccountsMgmtService.jsm
new file mode 100644
index 000000000000..fea70f1ab417
--- /dev/null
+++ b/b2g/components/FxAccountsMgmtService.jsm
@@ -0,0 +1,127 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Some specific (certified) apps need to get access to certain Firefox Accounts
+ * functionality that allows them to manage accounts (this is mostly sign up,
+ * sign in, logout and delete) and get information about the currently existing
+ * ones.
+ *
+ * This service listens for requests coming from these apps, triggers the
+ * appropriate Fx Accounts flows and send reponses back to the UI.
+ *
+ * The communication mechanism is based in mozFxAccountsContentEvent (for
+ * messages coming from the UI) and mozFxAccountsChromeEvent (for messages
+ * sent from the chrome side) custom events.
+ */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["FxAccountsMgmtService"];
+
+const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsManager",
+  "resource://gre/modules/FxAccountsManager.jsm");
+
+this.FxAccountsMgmtService = {
+
+  _sendChromeEvent: function(aMsg) {
+    if (!this._shell) {
+      return;
+    }
+    this._shell.sendCustomEvent("mozFxAccountsChromeEvent", aMsg);
+  },
+
+  _onFullfill: function(aMsgId, aData) {
+    this._sendChromeEvent({
+      id: aMsgId,
+      data: aData ? aData : null
+    });
+  },
+
+  _onReject: function(aMsgId, aReason) {
+    this._sendChromeEvent({
+      id: aMsgId,
+      error: aReason ? aReason : null
+    });
+  },
+
+  init: function() {
+    Services.obs.addObserver(this, "content-start", false);
+  },
+
+  observe: function(aSubject, aTopic, aData) {
+    this._shell = Services.wm.getMostRecentWindow("navigator:browser").shell;
+    let content = this._shell.contentBrowser.contentWindow;
+    content.addEventListener("mozFxAccountsContentEvent",
+                             FxAccountsMgmtService);
+    Services.obs.removeObserver(this, "content-start");
+  },
+
+  handleEvent: function(aEvent) {
+    let msg = aEvent.detail;
+    let self = FxAccountsMgmtService;
+
+    if (!msg.id) {
+      return;
+    }
+
+    let data = msg.data;
+    if (!data) {
+      return;
+    }
+
+    switch(data.method) {
+      case "getAccounts":
+        FxAccountsManager.getAccount().then(
+          account => {
+            // We only expose the email and verification status so far.
+            self._onFullfill(msg.id, account);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+      case "logout":
+        FxAccountsManager.signOut().then(
+          () => {
+            self._onFullfill(msg.id);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+      case "queryAccount":
+        FxAccountsManager.queryAccount(data.accountId).then(
+          result => {
+            self._onFullfill(msg.id, result);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+      case "signIn":
+      case "signUp":
+        FxAccountsManager[data.method](data.accountId, data.password).then(
+          user => {
+            self._onFullfill(msg.id, user);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+    }
+  }
+};
+
+FxAccountsMgmtService.init();
diff --git a/b2g/components/moz.build b/b2g/components/moz.build
index c5b6bb1dc2e1..331b6b1111cf 100644
--- a/b2g/components/moz.build
+++ b/b2g/components/moz.build
@@ -37,6 +37,7 @@ if CONFIG['MOZ_UPDATER']:
 
 EXTRA_JS_MODULES += [
     'ErrorPage.jsm',
+    'FxAccountsMgmtService.jsm',
     'SignInToWebsite.jsm',
     'TelURIParser.jsm',
     'WebappsUpdater.jsm',

From c9a5febee3fe59c2b55069f71bbd9ed4f0982945 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:27 +0100
Subject: [PATCH 105/144] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 4: Tests. r=markh

---
 .../fxaccounts/tests/xpcshell/test_manager.js | 583 ++++++++++++++++++
 .../fxaccounts/tests/xpcshell/xpcshell.ini    |   4 +-
 2 files changed, 586 insertions(+), 1 deletion(-)
 create mode 100644 services/fxaccounts/tests/xpcshell/test_manager.js

diff --git a/services/fxaccounts/tests/xpcshell/test_manager.js b/services/fxaccounts/tests/xpcshell/test_manager.js
new file mode 100644
index 000000000000..64ca648a6377
--- /dev/null
+++ b/services/fxaccounts/tests/xpcshell/test_manager.js
@@ -0,0 +1,583 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const Cm = Components.manager;
+
+Cu.import("resource://gre/modules/FxAccounts.jsm");
+Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsManager.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+// === Mocks ===
+
+// Override FxAccountsUIGlue.
+const kFxAccountsUIGlueUUID = "{8f6d5d87-41ed-4bb5-aa28-625de57564c5}";
+const kFxAccountsUIGlueContractID =
+  "@mozilla.org/fxaccounts/fxaccounts-ui-glue;1";
+
+// Save original FxAccountsUIGlue factory.
+const kFxAccountsUIGlueFactory =
+  Cm.getClassObject(Cc[kFxAccountsUIGlueContractID], Ci.nsIFactory);
+
+let fakeFxAccountsUIGlueFactory = {
+  createInstance: function(aOuter, aIid) {
+    return FxAccountsUIGlue.QueryInterface(aIid);
+  }
+};
+
+// FxAccountsUIGlue fake component.
+let FxAccountsUIGlue = {
+  _reject: false,
+
+  _error: 'error',
+
+  _signInFlowCalled: false,
+
+  _reset: function() {
+    this._reject = false;
+    this._error = 'error';
+    this._signInFlowCalled = false;
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIFxAccountsUIGlue]),
+
+  getUserPermission: function() {},
+
+  signInFlow: function() {
+    this._signInFlowCalled = true;
+    let deferred = Promise.defer();
+
+    if (this._reject) {
+      deferred.reject(this._error);
+    } else {
+      FxAccountsManager._activeSession = {
+        email: "user@domain.org",
+        verified: false,
+        sessionToken: "1234"
+      };
+      FxAccountsManager._fxAccounts
+                       .setSignedInUser(FxAccountsManager._activeSession);
+      deferred.resolve();
+    }
+
+    return deferred.promise;
+  }
+};
+
+(function registerFakeFxAccountsUIGlue() {
+  Cm.QueryInterface(Ci.nsIComponentRegistrar)
+    .registerFactory(Components.ID(kFxAccountsUIGlueUUID),
+                     "FxAccountsUIGlue",
+                     kFxAccountsUIGlueContractID,
+                     fakeFxAccountsUIGlueFactory);
+})();
+
+// Save original fxAccounts instance
+const kFxAccounts = fxAccounts;
+// and change it for a mock FxAccounts.
+FxAccountsManager._fxAccounts = {
+  _reject: false,
+  _getSignedInUserCalled: false,
+  _setSignedInUserCalled: false,
+
+  _error: 'error',
+  _assertion: 'assertion',
+  _signedInUser: null,
+
+  _reset: function() {
+    this._getSignedInUserCalled = false;
+    this._setSignedInUserCalled = false;
+    this._reject = false;
+  },
+
+  getAssertion: function() {
+    if (!this._signedInUser) {
+      return null;
+    }
+
+    let deferred = Promise.defer();
+    deferred.resolve(this._assertion);
+    return deferred.promise;
+  },
+
+  getSignedInUser: function() {
+    this._getSignedInUserCalled = true;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject(this._error)
+                 : deferred.resolve(this._signedInUser);
+    return deferred.promise;
+  },
+
+  setSignedInUser: function(user) {
+    this._setSignedInUserCalled = true;
+    let deferred = Promise.defer();
+    this._signedInUser = user;
+    deferred.resolve();
+    return deferred.promise;
+  },
+
+  signOut: function() {
+    let deferred = Promise.defer();
+    this._signedInUser = null;
+    deferred.resolve();
+    return deferred.promise;
+  }
+};
+
+// Save original FxAccountsClient factory from FxAccountsManager.
+const kFxAccountsClient = FxAccountsManager._createFxAccountsClient;
+// and change it for a fake client factory.
+let FakeFxAccountsClient = {
+  _reject: false,
+  _recoveryEmailStatusCalled: false,
+  _signInCalled: false,
+  _signUpCalled: false,
+  _signOutCalled: false,
+
+  _accountExists: false,
+  _verified: false,
+  _password: null,
+
+  _reset: function() {
+    this._reject = false;
+    this._recoveryEmailStatusCalled = false;
+    this._signInCalled = false;
+    this._signUpCalled = false;
+    this._signOutCalled = false;
+  },
+
+  recoveryEmailStatus: function() {
+    this._recoveryEmailStatusCalled = true;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve({ verified: this._verified });
+    return deferred.promise;
+  },
+
+  signIn: function(user, password) {
+    this._signInCalled = true;
+    this._password = password;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve({ email: user,
+                                      uid: "whatever",
+                                      verified: this._verified,
+                                      sessionToken: "1234" });
+    return deferred.promise;
+  },
+
+  signUp: function(user, password) {
+    this._signUpCalled = true;
+    return this.signIn(user, password);
+  },
+
+  signOut: function() {
+    this._signOutCalled = true;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve();
+    return deferred.promise;
+  },
+
+  accountExists: function() {
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve(this._accountExists);
+    return deferred.promise;
+  }
+};
+FxAccountsManager._createFxAccountsClient = function() {
+  return FakeFxAccountsClient;
+}
+
+// === Global cleanup ===
+
+// Unregister mocks and restore original code.
+do_register_cleanup(function() {
+  // Unregister the factory so we do not leak
+  Cm.QueryInterface(Ci.nsIComponentRegistrar)
+    .unregisterFactory(Components.ID(kFxAccountsUIGlueUUID),
+                       fakeFxAccountsUIGlueFactory);
+
+  // Restore the original factory.
+  Cm.QueryInterface(Ci.nsIComponentRegistrar)
+    .registerFactory(Components.ID(kFxAccountsUIGlueUUID),
+                     "FxAccountsUIGlue",
+                     kFxAccountsUIGlueContractID,
+                     kFxAccountsUIGlueFactory);
+
+  // Restore the original FxAccounts instance from FxAccountsManager.
+  FxAccountsManager._fxAccounts = kFxAccounts;
+
+  // Restore the FxAccountsClient getter from FxAccountsManager.
+  FxAccountsManager._createFxAccountsClient = kFxAccountsClient;
+});
+
+
+// === Tests ===
+
+function run_test() {
+  run_next_test();
+}
+
+add_test(function test_initial_state() {
+  do_print("= Test 0 | Initial state =");
+  do_check_neq(FxAccountsManager, undefined);
+  do_check_null(FxAccountsManager._activeSession);
+  do_check_null(FxAccountsManager._user);
+  run_next_test();
+});
+
+add_test(function(test_getAccount_no_session) {
+  do_print("= Test 1 | getAccount no session =");
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_null(result);
+      do_check_null(FxAccountsManager._activeSession);
+      do_check_null(FxAccountsManager._user);
+      do_check_true(FxAccountsManager._fxAccounts._getSignedInUserCalled);
+      FxAccountsManager._fxAccounts._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAssertion_no_audience) {
+  do_print("= Test 2 | getAssertion no audience =");
+  FxAccountsManager.getAssertion().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_AUDIENCE);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_no_session_ui_error) {
+  do_print("= Test 3 | getAssertion no session, UI error =");
+  FxAccountsUIGlue._reject = true;
+  FxAccountsManager.getAssertion("audience").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_UI_ERROR);
+      do_check_eq(error.details, "error");
+      FxAccountsUIGlue._reset();
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_no_session_ui_success) {
+  do_print("= Test 4 | getAssertion no session, UI success =");
+  FxAccountsManager.getAssertion("audience").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_true(FxAccountsUIGlue._signInFlowCalled);
+      do_check_eq(error.error, ERROR_UNVERIFIED_ACCOUNT);
+      FxAccountsUIGlue._reset();
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_active_session_unverified_account) {
+  do_print("= Test 5 | getAssertion active session, unverified account =");
+  FxAccountsManager.getAssertion("audience").then(
+    result => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_false(FxAccountsUIGlue._signInFlowCalled);
+      do_check_eq(error.error, ERROR_UNVERIFIED_ACCOUNT);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_active_session_verified_account) {
+  do_print("= Test 6 | getAssertion active session, verified account =");
+  FxAccountsManager._fxAccounts._signedInUser.verified = true;
+  FxAccountsManager._activeSession.verified = true;
+  FxAccountsManager.getAssertion("audience").then(
+    result => {
+      do_check_false(FxAccountsUIGlue._signInFlowCalled);
+      do_check_eq(result, "assertion");
+      FxAccountsManager._fxAccounts._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAccount_existing_verified_session) {
+  do_print("= Test 7 | getAccount, existing verified session =");
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_false(FxAccountsManager._fxAccounts._getSignedInUserCalled);
+      do_check_eq(result.accountId, FxAccountsManager._user.accountId);
+      do_check_eq(result.verified, FxAccountsManager._user.verified);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAccount_existing_unverified_session_unverified_user) {
+  do_print("= Test 8 | getAccount, existing unverified session, unverified user =");
+  FxAccountsManager._activeSession.verified = false;
+  FxAccountsManager._fxAccounts._signedInUser.verified = false;
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_false(result.verified);
+      do_check_eq(result.accountId, FxAccountsManager._user.accountId);
+      FakeFxAccountsClient._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAccount_existing_unverified_session_verified_user) {
+  do_print("= Test 8 | getAccount, existing unverified session, verified user =");
+  FxAccountsManager._activeSession.verified = false;
+  FxAccountsManager._fxAccounts._signedInUser.verified = false;
+  FakeFxAccountsClient._verified = true;
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_true(result.verified);
+      do_check_eq(result.accountId, FxAccountsManager._user.accountId);
+      FakeFxAccountsClient._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_signOut) {
+  do_print("= Test 9 | signOut =");
+  do_check_true(FxAccountsManager._activeSession != null);
+  FxAccountsManager.signOut().then(
+    result => {
+      do_check_null(result);
+      do_check_null(FxAccountsManager._activeSession);
+      do_check_true(FakeFxAccountsClient._signOutCalled);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_verificationStatus_no_token_session) {
+  do_print("= Test 10 | verificationStatus, no token session =");
+  do_check_null(FxAccountsManager._activeSession);
+  FxAccountsManager.verificationStatus().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_NO_TOKEN_SESSION);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signUp_no_accountId) {
+  do_print("= Test 11 | signUp, no accountId=");
+  FxAccountsManager.signUp().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_ACCOUNTID);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signIn_no_accountId) {
+  do_print("= Test 12 | signIn, no accountId=");
+  FxAccountsManager.signIn().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_ACCOUNTID);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signUp_no_password) {
+  do_print("= Test 13 | signUp, no accountId=");
+  FxAccountsManager.signUp("user@domain.org").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_PASSWORD);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signIn_no_accountId) {
+  do_print("= Test 14 | signIn, no accountId=");
+  FxAccountsManager.signIn("user@domain.org").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_PASSWORD);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signUp) {
+  do_print("= Test 15 | signUp =");
+  FakeFxAccountsClient._verified = false;
+  FxAccountsManager.signUp("user@domain.org", "password").then(
+    result => {
+      do_check_true(FakeFxAccountsClient._signInCalled);
+      do_check_true(FakeFxAccountsClient._signUpCalled);
+      do_check_true(FxAccountsManager._fxAccounts._getSignedInUserCalled);
+      do_check_eq(FxAccountsManager._fxAccounts._signedInUser.email, "user@domain.org");
+      do_check_eq(FakeFxAccountsClient._password, "password");
+      do_check_true(result.accountCreated);
+      do_check_eq(result.user.accountId, "user@domain.org");
+      do_check_false(result.user.verified);
+      FakeFxAccountsClient._reset();
+      FxAccountsManager._fxAccounts._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error.error);
+    }
+  );
+});
+
+add_test(function(test_signUp_already_signed_user) {
+  do_print("= Test 16 | signUp, already signed user =");
+  FxAccountsManager.signUp("user@domain.org", "password").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_false(FakeFxAccountsClient._signInCalled);
+      do_check_eq(error.error, ERROR_ALREADY_SIGNED_IN_USER);
+      do_check_eq(error.details.user.accountId, "user@domain.org");
+      do_check_false(error.details.user.verified);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signIn_already_signed_user) {
+  do_print("= Test 17 | signIn, already signed user =");
+  FxAccountsManager.signIn("user@domain.org", "password").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_ALREADY_SIGNED_IN_USER);
+      do_check_eq(error.details.user.accountId, "user@domain.org");
+      do_check_false(error.details.user.verified);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_verificationStatus_unverified_session_unverified_user) {
+  do_print("= Test 18 | verificationStatus unverified session and user =");
+  FakeFxAccountsClient._verified = false;
+  FxAccountsManager.verificationStatus().then(
+    user => {
+      do_check_false(user.verified);
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_false(FxAccountsManager._fxAccounts._setSignedInUserCalled);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_verificationStatus_unverified_session_verified_user) {
+  do_print("= Test 19 | verificationStatus unverified session, verified user =");
+  FakeFxAccountsClient._verified = true;
+  FxAccountsManager.verificationStatus().then(
+    user => {
+      do_check_true(user.verified);
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_true(FxAccountsManager._fxAccounts._setSignedInUserCalled);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_queryAccount_no_exists) {
+  do_print("= Test 20 | queryAccount, no exists =");
+  FxAccountsManager.queryAccount("user@domain.org").then(
+    result => {
+      do_check_false(result.registered);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_queryAccount_exists) {
+  do_print("= Test 21 | queryAccount, exists =");
+  FakeFxAccountsClient._accountExists = true;
+  FxAccountsManager.queryAccount("user@domain.org").then(
+    result => {
+      do_check_true(result.registered);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_queryAccount_no_accountId) {
+  do_print("= Test 22 | queryAccount, no accountId =");
+  FxAccountsManager.queryAccount().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_ACCOUNTID);
+      run_next_test();
+    }
+  );
+});
diff --git a/services/fxaccounts/tests/xpcshell/xpcshell.ini b/services/fxaccounts/tests/xpcshell/xpcshell.ini
index 414a3649bd92..8b09ed856fe6 100644
--- a/services/fxaccounts/tests/xpcshell/xpcshell.ini
+++ b/services/fxaccounts/tests/xpcshell/xpcshell.ini
@@ -4,4 +4,6 @@ tail =
 
 [test_accounts.js]
 [test_client.js]
-
+[test_manager.js]
+run-if = appname == 'b2g'
+reason = FxAccountsManager is only available for B2G for now

From 6f4e632c54fc8c13dbc7f331056c3707bc859d98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:37:55 +0100
Subject: [PATCH 106/144] Bug 943998 - Need debug and uri pref for
 FirefoxAccounts. r=markh

--HG--
rename : services/fxaccounts/FxAccountsConsts.js => services/fxaccounts/FxAccountsCommon.js
---
 b2g/components/FxAccountsMgmtService.jsm      |  2 +
 b2g/components/FxAccountsUIGlue.js            | 13 +++++--
 services/fxaccounts/FxAccounts.jsm            | 18 +--------
 services/fxaccounts/FxAccountsClient.jsm      |  8 ++++
 ...xAccountsConsts.js => FxAccountsCommon.js} | 27 ++++++++++++++
 services/fxaccounts/FxAccountsManager.jsm     | 37 ++++++++++++++++++-
 services/fxaccounts/moz.build                 |  2 +-
 .../fxaccounts/tests/xpcshell/test_manager.js |  2 +-
 8 files changed, 84 insertions(+), 25 deletions(-)
 rename services/fxaccounts/{FxAccountsConsts.js => FxAccountsCommon.js} (84%)

diff --git a/b2g/components/FxAccountsMgmtService.jsm b/b2g/components/FxAccountsMgmtService.jsm
index fea70f1ab417..d737fd1109b5 100644
--- a/b2g/components/FxAccountsMgmtService.jsm
+++ b/b2g/components/FxAccountsMgmtService.jsm
@@ -25,6 +25,7 @@ const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsManager",
   "resource://gre/modules/FxAccountsManager.jsm");
@@ -66,6 +67,7 @@ this.FxAccountsMgmtService = {
 
   handleEvent: function(aEvent) {
     let msg = aEvent.detail;
+    log.debug("Got content msg " + JSON.stringify(msg));
     let self = FxAccountsMgmtService;
 
     if (!msg.id) {
diff --git a/b2g/components/FxAccountsUIGlue.js b/b2g/components/FxAccountsUIGlue.js
index a2650237cc90..8fa0987278cc 100644
--- a/b2g/components/FxAccountsUIGlue.js
+++ b/b2g/components/FxAccountsUIGlue.js
@@ -10,6 +10,7 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/ObjectWrapper.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyServiceGetter(this, "uuidgen",
                                    "@mozilla.org/uuid-generator;1",
@@ -43,6 +44,8 @@ FxAccountsUIGlue.prototype = {
         return;
       }
 
+      log.debug("Got content event " + JSON.stringify(msg));
+
       if (msg.error) {
         deferred.reject(msg);
       } else {
@@ -52,10 +55,12 @@ FxAccountsUIGlue.prototype = {
                                   onContentEvent);
     });
 
-    this._browser.shell.sendCustomEvent("mozFxAccountsRPChromeEvent", {
-      method: "openFlow",
-      id: id
-    });
+    let detail = {
+       method: "openFlow",
+       id: id
+    };
+    log.debug("Send chrome event " + JSON.stringify(detail));
+    this._browser.shell.sendCustomEvent("mozFxAccountsRPChromeEvent", detail);
 
     return deferred.promise;
   },
diff --git a/services/fxaccounts/FxAccounts.jsm b/services/fxaccounts/FxAccounts.jsm
index c7efa8429b9b..50f9e5a42f5d 100644
--- a/services/fxaccounts/FxAccounts.jsm
+++ b/services/fxaccounts/FxAccounts.jsm
@@ -16,27 +16,11 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Timer.jsm");
 Cu.import("resource://gre/modules/Task.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
-Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "jwcrypto",
                                   "resource://gre/modules/identity/jwcrypto.jsm");
 
-// loglevel preference should be one of: "FATAL", "ERROR", "WARN", "INFO",
-// "CONFIG", "DEBUG", "TRACE" or "ALL". We will be logging error messages by
-// default.
-const PREF_LOG_LEVEL = "identity.fxaccounts.loglevel";
-try {
-  this.LOG_LEVEL =
-    Services.prefs.getPrefType(PREF_LOG_LEVEL) == Ci.nsIPrefBranch.PREF_STRING
-    && Services.prefs.getCharPref(PREF_LOG_LEVEL);
-} catch (e) {
-  this.LOG_LEVEL = Log.Level.Error;
-}
-
-let log = Log.repository.getLogger("Services.FxAccounts");
-log.level = LOG_LEVEL;
-log.addAppender(new Log.ConsoleAppender(new Log.BasicFormatter()));
-
 InternalMethods = function(mock) {
   this.cert = null;
   this.keyPair = null;
diff --git a/services/fxaccounts/FxAccountsClient.jsm b/services/fxaccounts/FxAccountsClient.jsm
index 5f5df829b77b..09438adbe112 100644
--- a/services/fxaccounts/FxAccountsClient.jsm
+++ b/services/fxaccounts/FxAccountsClient.jsm
@@ -10,6 +10,7 @@ Cu.import("resource://gre/modules/Promise.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://services-common/utils.js");
 Cu.import("resource://services-crypto/utils.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 // Default can be changed by the preference 'identity.fxaccounts.auth.uri'
 let _host = "https://api-accounts.dev.lcip.org/v1";
@@ -283,6 +284,9 @@ this.FxAccountsClient.prototype = {
       payload = JSON.stringify(jsonPayload);
     }
 
+    log.debug("(HAWK request) - Path: " + path + " - Method: " + method +
+              " - Payload: " + payload);
+
     xhr.open(method, URI);
     xhr.channel.loadFlags = Ci.nsIChannel.LOAD_BYPASS_CACHE |
                             Ci.nsIChannel.INHIBIT_CACHING;
@@ -300,12 +304,16 @@ this.FxAccountsClient.prototype = {
     xhr.onload = function onload() {
       try {
         let response = JSON.parse(xhr.responseText);
+        log.debug("(Response) Code: " + xhr.status + " - Status text: " +
+                  xhr.statusText + " - Response text: " + xhr.responseText);
         if (xhr.status !== 200 || response.error) {
           // In this case, the response is an object with error information.
           return deferred.reject(response);
         }
         deferred.resolve(response);
       } catch (e) {
+        log.error("(Response) Code: " + xhr.status + " - Status text: " +
+                  xhr.statusText);
         deferred.reject(constructError(e));
       }
     };
diff --git a/services/fxaccounts/FxAccountsConsts.js b/services/fxaccounts/FxAccountsCommon.js
similarity index 84%
rename from services/fxaccounts/FxAccountsConsts.js
rename to services/fxaccounts/FxAccountsCommon.js
index 51e8427b038a..1c65449bcaee 100644
--- a/services/fxaccounts/FxAccountsConsts.js
+++ b/services/fxaccounts/FxAccountsCommon.js
@@ -2,6 +2,33 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+const { interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/Log.jsm");
+
+// loglevel should be one of "Fatal", "Error", "Warn", "Info", "Config",
+// "Debug", "Trace" or "All". If none is specified, "Error" will be used by
+// default.
+const PREF_LOG_LEVEL = "identity.fxaccounts.loglevel";
+
+XPCOMUtils.defineLazyGetter(this, 'log', function() {
+  let log = Log.repository.getLogger("FirefoxAccounts");
+  log.addAppender(new Log.DumpAppender());
+  log.level = Log.Level.Error;
+  try {
+    let level =
+      Services.prefs.getPrefType(PREF_LOG_LEVEL) == Ci.nsIPrefBranch.PREF_STRING
+      && Services.prefs.getCharPref(PREF_LOG_LEVEL);
+    log.level = Log.Level[level] || Log.Level.Error;
+  } catch (e) {
+    log.error(e);
+  }
+
+  return log;
+});
+
 this.DATA_FORMAT_VERSION = 1;
 this.DEFAULT_STORAGE_FILENAME = "signedInUser.json";
 
diff --git a/services/fxaccounts/FxAccountsManager.jsm b/services/fxaccounts/FxAccountsManager.jsm
index ea45c30cbb8b..cbae6cd0f959 100644
--- a/services/fxaccounts/FxAccountsManager.jsm
+++ b/services/fxaccounts/FxAccountsManager.jsm
@@ -19,7 +19,7 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
-Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsClient",
   "resource://gre/modules/FxAccountsClient.jsm");
@@ -50,7 +50,9 @@ this.FxAccountsManager = {
     if (!aServerResponse || !aServerResponse.error || !aServerResponse.error.errno) {
       return;
     }
-    return SERVER_ERRNO_TO_ERROR[aServerResponse.error.errno];
+    let error = SERVER_ERRNO_TO_ERROR[aServerResponse.error.errno];
+    log.error(error);
+    return error;
   },
 
   _serverError: function(aServerResponse) {
@@ -69,18 +71,21 @@ this.FxAccountsManager = {
 
   _signInSignUp: function(aMethod, aAccountId, aPassword) {
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
     }
 
     if (!aAccountId) {
+      log.error(ERROR_INVALID_ACCOUNTID);
       return Promise.reject({
         error: ERROR_INVALID_ACCOUNTID
       });
     }
 
     if (!aPassword) {
+      log.error(ERROR_INVALID_PASSWORD);
       return Promise.reject({
         error: ERROR_INVALID_PASSWORD
       });
@@ -88,6 +93,7 @@ this.FxAccountsManager = {
 
     // Check that there is no signed in account first.
     if (this._activeSession) {
+      log.error(ERROR_ALREADY_SIGNED_IN_USER);
       return Promise.reject({
         error: ERROR_ALREADY_SIGNED_IN_USER,
         details: {
@@ -100,6 +106,7 @@ this.FxAccountsManager = {
     return this._fxAccounts.getSignedInUser().then(
       user => {
         if (user) {
+          log.error(ERROR_ALREADY_SIGNED_IN_USER);
           return Promise.reject({
             error: ERROR_ALREADY_SIGNED_IN_USER,
             details: {
@@ -113,6 +120,7 @@ this.FxAccountsManager = {
       user => {
         let error = this._getError(user);
         if (!user || !user.uid || !user.sessionToken || error) {
+          log.error(error ? error : ERROR_INTERNAL_INVALID_USER);
           return Promise.reject({
             error: error ? error : ERROR_INTERNAL_INVALID_USER,
             details: {
@@ -126,6 +134,8 @@ this.FxAccountsManager = {
         return this._fxAccounts.setSignedInUser(user, false).then(
           () => {
             this._activeSession = user;
+            log.debug("User signed in: " + JSON.stringify(this._user) +
+                      " - Account created " + (aMethod == "signUp"));
             return Promise.resolve({
               accountCreated: aMethod === "signUp",
               user: this._user
@@ -169,6 +179,7 @@ this.FxAccountsManager = {
                 details: result
               });
             }
+            log.debug("Signed out");
             return Promise.resolve();
           },
           reason => {
@@ -218,6 +229,7 @@ this.FxAccountsManager = {
         return this.verificationStatus(this._activeSession);
       }
 
+      log.debug("Account " + JSON.stringify(this._user));
       return Promise.resolve(this._user);
     }
 
@@ -225,6 +237,7 @@ this.FxAccountsManager = {
     return this._fxAccounts.getSignedInUser().then(
       user => {
         if (!user || !user.email) {
+          log.debug("No signed in account");
           return Promise.resolve(null);
         }
 
@@ -233,16 +246,20 @@ this.FxAccountsManager = {
         // we check this information with the server, update the stored
         // data if needed and finally return the account details.
         if (!user.verified && !Services.io.offline) {
+          log.debug("Unverified account");
           return this.verificationStatus(user);
         }
 
+        log.debug("Account " + JSON.stringify(this._user));
         return Promise.resolve(this._user);
       }
     );
   },
 
   queryAccount: function(aAccountId) {
+    log.debug("queryAccount " + aAccountId);
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
@@ -251,6 +268,7 @@ this.FxAccountsManager = {
     let deferred = Promise.defer();
 
     if (!aAccountId) {
+      log.error(ERROR_INVALID_ACCOUNTID);
       return Promise.reject({
         error: ERROR_INVALID_ACCOUNTID
       });
@@ -259,6 +277,7 @@ this.FxAccountsManager = {
     let client = this._createFxAccountsClient();
     return client.accountExists(aAccountId).then(
       result => {
+        log.debug("Account " + result ? "" : "does not" + " exists");
         let error = this._getError(result);
         if (error) {
           return Promise.reject({
@@ -276,7 +295,9 @@ this.FxAccountsManager = {
   },
 
   verificationStatus: function() {
+    log.debug("verificationStatus");
     if (!this._activeSession || !this._activeSession.sessionToken) {
+      log.error(ERROR_NO_TOKEN_SESSION);
       return Promise.reject({
         error: ERROR_NO_TOKEN_SESSION
       });
@@ -285,10 +306,12 @@ this.FxAccountsManager = {
     // There is no way to unverify an already verified account, so we just
     // return the account details of a verified account
     if (this._activeSession.verified) {
+      log.debug("Account already verified");
       return Promise.resolve(this._user);
     }
 
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
@@ -312,10 +335,12 @@ this.FxAccountsManager = {
           this._activeSession.verified = data.verified;
           return this._fxAccounts.setSignedInUser(this._activeSession).then(
             () => {
+              log.debug(JSON.stringify(this._user));
               return Promise.resolve(this._user);
             }
           );
         }
+        log.debug(JSON.stringify(this._user));
         return Promise.resolve(this._user);
       },
       reason => { return this._serverError(reason); }
@@ -323,13 +348,16 @@ this.FxAccountsManager = {
   },
 
   getAssertion: function(aAudience) {
+    log.debug("getAssertion " + aAudience);
     if (!aAudience) {
+      log.error(ERROR_INVALID_AUDIENCE);
       return Promise.reject({
         error: ERROR_INVALID_AUDIENCE
       });
     }
 
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
@@ -343,6 +371,7 @@ this.FxAccountsManager = {
             return this._getAssertion(aAudience);
           }
 
+          log.error(ERROR_UNVERIFIED_ACCOUNT);
           return Promise.reject({
             error: ERROR_UNVERIFIED_ACCOUNT,
             details: {
@@ -351,6 +380,7 @@ this.FxAccountsManager = {
           });
         }
 
+        log.debug("No signed in user");
         // If there is no currently signed in user, we trigger the signIn UI
         // flow.
         let ui = Cc["@mozilla.org/fxaccounts/fxaccounts-ui-glue;1"]
@@ -362,6 +392,8 @@ this.FxAccountsManager = {
             if (result && result.verified) {
               return this._getAssertion(aAudience);
             }
+
+            log.error(ERROR_UNVERIFIED_ACCOUNT);
             return Promise.reject({
               error: ERROR_UNVERIFIED_ACCOUNT,
               details: {
@@ -370,6 +402,7 @@ this.FxAccountsManager = {
             });
           },
           error => {
+            log.error(ERROR_UI_ERROR + " " + error);
             return Promise.reject({
               error: ERROR_UI_ERROR,
               details: error
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 060361da2e73..a2e055171d34 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -11,7 +11,7 @@ TEST_DIRS += ['tests']
 EXTRA_JS_MODULES += [
   'FxAccounts.jsm',
   'FxAccountsClient.jsm',
-  'FxAccountsConsts.js'
+  'FxAccountsCommon.js'
 ]
 
 # For now, we will only be using the FxA manager in B2G.
diff --git a/services/fxaccounts/tests/xpcshell/test_manager.js b/services/fxaccounts/tests/xpcshell/test_manager.js
index 64ca648a6377..0261f6826e99 100644
--- a/services/fxaccounts/tests/xpcshell/test_manager.js
+++ b/services/fxaccounts/tests/xpcshell/test_manager.js
@@ -6,7 +6,7 @@
 const Cm = Components.manager;
 
 Cu.import("resource://gre/modules/FxAccounts.jsm");
-Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/FxAccountsManager.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
 

From 95b0903c9b6eb850bb3ae2d38a6848db4ac0f839 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 03:50:24 -0800
Subject: [PATCH 107/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

========

https://hg.mozilla.org/integration/gaia-central/rev/47f28091eeed
Author: Germán Toro del Valle <gtorodelvalle@gmail.com>
Desc: Merge pull request #14581 from gtorodelvalle/contacts-bug-938261-contact-update-activity

Bug 938219 - [Contacts] Unable to select a contact via the contact update activity (r=jmcanterafonseca)

========

https://hg.mozilla.org/integration/gaia-central/rev/8c3e597f021a
Author: Germán Toro del Valle <gtorodelvalle@gmail.com>
Desc: Bug 938219 - [Contacts] Unable to select a contact via the contact update activity
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 4af865b42e96..067688b5db04 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "28714578feeae99aa02527711279d07671120ebf", 
+    "revision": "47f28091eeed8c209e062f7103884a07dcbfe356", 
     "repo_path": "/integration/gaia-central"
 }

From ae87d1f0e4c27a0b522fc891819d497f5bcb166d Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 04:40:25 -0800
Subject: [PATCH 108/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/ae3c8b28cffd
Author: Jose M. Cantera <jmcanterafonseca@gmail.com>
Desc: Merge pull request #14645 from jmcanterafonseca/fix_flush_final2

Bug 949422 - If a Facebook Friend is removed (from the import list), the...

========

https://hg.mozilla.org/integration/gaia-central/rev/8c8a30087bda
Author: Jose M. Cantera <jmcanterafonseca@gmail.com>
Desc: Bug 949422 - If a Facebook Friend is removed (from the import list), then it cannot be imported anymore
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 067688b5db04..ca138f665e8b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "47f28091eeed8c209e062f7103884a07dcbfe356", 
+    "revision": "ae3c8b28cffd4c5bfc7d467b5c41cafaa36f90f7", 
     "repo_path": "/integration/gaia-central"
 }

From a95cb55213e1710ed62ad82d1e7b2ef744fb50ba Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 05:30:24 -0800
Subject: [PATCH 109/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/70b8a8a631b1
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14463 from julienw/946678-use-href-for-activity

Bug 946678 - [Messaging] Creating a new message from contacts does not o...

========

https://hg.mozilla.org/integration/gaia-central/rev/64158f1e1f9c
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 946678 - [Messaging] Creating a new message from contacts does not open the messaging composer when Messaging app is in background r=borja

Adds a hash for the "new" activity. This will have the side-effect of not
registering the notification and sms-received system message handlers which is a
good thing.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ca138f665e8b..6e5456b34463 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "ae3c8b28cffd4c5bfc7d467b5c41cafaa36f90f7", 
+    "revision": "70b8a8a631b10fa935522047d75e0eb0f5e12d0c", 
     "repo_path": "/integration/gaia-central"
 }

From 8116f4edccb4b5325b43cc6742a9a70f7c348f43 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 05:45:29 -0800
Subject: [PATCH 110/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/2f4600ab2988
Author: Florin Strugariu <bebef_1987@yahoo.com>
Desc: Merge pull request #14627 from askeing/949552

Bug 949552 - Fix test_gallery_delete_image

========

https://hg.mozilla.org/integration/gaia-central/rev/8bad640ac1b8
Author: askeing <askeing@gmail.com>
Desc: Bug 949552 - Fix test_gallery_delete_image
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6e5456b34463..13be138e1cf7 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "70b8a8a631b10fa935522047d75e0eb0f5e12d0c", 
+    "revision": "2f4600ab2988317700fbe056ee4d2704f424f147", 
     "repo_path": "/integration/gaia-central"
 }

From d5d139697643125338f6d3f49648ad2d7dc92360 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 06:45:24 -0800
Subject: [PATCH 111/144] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/28944ec8ca72
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Bug 949897 - Disable test_cards_view_kill_apps_with_two_apps.py r=me

========

https://hg.mozilla.org/integration/gaia-central/rev/2b84917bc9f1
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Merge pull request #14604 from jaoo/928294

Bug 928294 - [DSDS][Gaia] Settings app should support call settings of multiple sim cards. r=arthurcc

========

https://hg.mozilla.org/integration/gaia-central/rev/2e916b992987
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Bug 928294 - [DSDS][Gaia] Settings app should support call settings of multiple sim cards

========

https://hg.mozilla.org/integration/gaia-central/rev/dace64b0307f
Author: Bebe <bebe@mozilla.ro>
Desc: Bug 949405 - Bump gaiatest version to 0.21.2. r=dhunt
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 13be138e1cf7..39ca10424b1f 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "2f4600ab2988317700fbe056ee4d2704f424f147", 
+    "revision": "28944ec8ca72535f50b097e8277ef111e3963bd7", 
     "repo_path": "/integration/gaia-central"
 }

From 238b35ae84805b82595721368e502e7aeaa4d860 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 23:30:35 +0800
Subject: [PATCH 112/144] Bug 943263: B2G MMS - add test cases for
 MobileMessageDB::forEachMatchedMmsDeliveryInfo. r=gene

---
 .../tests/marionette/manifest.ini             |   1 +
 ...test_mmdb_foreachmatchedmmsdeliveryinfo.js | 114 ++++++++++++++++++
 .../tests/marionette/test_mmdb_new.js         |   2 +
 3 files changed, 117 insertions(+)
 create mode 100644 dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js

diff --git a/dom/mobilemessage/tests/marionette/manifest.ini b/dom/mobilemessage/tests/marionette/manifest.ini
index bb7316194ce4..7746dac1447f 100644
--- a/dom/mobilemessage/tests/marionette/manifest.ini
+++ b/dom/mobilemessage/tests/marionette/manifest.ini
@@ -41,4 +41,5 @@ qemu = true
 [test_thread_subject.js]
 [test_mmdb_new.js]
 [test_mmdb_setmessagedeliverybyid_sms.js]
+[test_mmdb_foreachmatchedmmsdeliveryinfo.js]
 [test_replace_short_message_type.js]
diff --git a/dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js b/dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js
new file mode 100644
index 000000000000..57b6b19310d0
--- /dev/null
+++ b/dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js
@@ -0,0 +1,114 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+// TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+// empty object in return.
+let mmdb;
+
+const PHONE_0 = "+15555215500";
+const PHONE_1 = "+15555215501";
+const PHONE_2 = "+15555215502";
+const PHONE_2_NET = "5555215502";
+const PHONE_3 = "+15555215503";
+const PHONE_3_NET = "5555215503";
+const EMAIL_1 = "foo@bar.com";
+let deliveryInfo = [
+  { receiver: PHONE_1 },
+  { receiver: PHONE_2 },
+  { receiver: PHONE_1 },
+  { receiver: PHONE_2_NET },
+  { receiver: PHONE_3_NET },
+  { receiver: EMAIL_1 },
+  { receiver: PHONE_3 },
+];
+
+function clearTraversed(aDeliveryInfo) {
+  for (let element of aDeliveryInfo) {
+    delete element.traversed;
+  }
+}
+
+function doTest(aMmdb, aNeedle, aVerifyFunc, aCount) {
+  log("  '" + aNeedle + "': " + aCount);
+
+  clearTraversed(deliveryInfo);
+
+  let count = 0;
+  aMmdb.forEachMatchedMmsDeliveryInfo(deliveryInfo, aNeedle, function(aElement) {
+    ok(true, "checking " + aElement.receiver);
+    ok(!aElement.hasOwnProperty("traversed"), "element.traversed");
+    aVerifyFunc(aElement);
+
+    aElement.traversed = true;
+    ++count;
+  });
+  is(count, aCount, "matched count");
+}
+
+function testNotFound(aMmdb) {
+  log("Testing unavailable");
+
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
+  aMmdb = mmdb;
+
+  doTest(aMmdb, PHONE_0, function(aElement) {
+    ok(false, "Should never have a match");
+  }, 0);
+
+  return aMmdb;
+}
+
+function testDirectMatch(aMmdb) {
+  log("Testing direct matching");
+
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
+  aMmdb = mmdb;
+
+  for (let needle of [PHONE_1, EMAIL_1]) {
+    let count = deliveryInfo.reduce(function(aCount, aElement) {
+      return aElement.receiver == needle ? aCount + 1 : aCount;
+    }, 0);
+    doTest(aMmdb, needle, function(aElement) {
+      is(aElement.receiver, needle, "element.receiver");
+    }, count);
+  }
+
+  return aMmdb;
+}
+
+function testPhoneMatch(aMmdb) {
+  log("Testing phone matching");
+
+  let verifyFunc = function(aValid, aElement) {
+    ok(aValid.indexOf(aElement.receiver) >= 0, "element.receiver");
+  };
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
+  aMmdb = mmdb;
+
+  let matchingGroups = [
+    [PHONE_2, PHONE_2_NET],
+    [PHONE_3, PHONE_3_NET],
+  ];
+  for (let group of matchingGroups) {
+    for (let item of group) {
+      doTest(aMmdb, item, verifyFunc.bind(null, group), group.length);
+    }
+  }
+
+  return aMmdb;
+}
+
+startTestBase(function testCaseMain() {
+  mmdb = newMobileMessageDB();
+  return initMobileMessageDB(mmdb, "test_mmdb_foreachmatchedmmsdeliveryinfo", 0)
+    .then(testNotFound)
+    .then(testDirectMatch)
+    .then(testPhoneMatch)
+    .then(closeMobileMessageDB.bind(null, mmdb));
+});
diff --git a/dom/mobilemessage/tests/marionette/test_mmdb_new.js b/dom/mobilemessage/tests/marionette/test_mmdb_new.js
index da34b13ca9d4..be6fa2fcb260 100644
--- a/dom/mobilemessage/tests/marionette/test_mmdb_new.js
+++ b/dom/mobilemessage/tests/marionette/test_mmdb_new.js
@@ -7,6 +7,8 @@ MARIONETTE_HEAD_JS = 'head.js';
 startTestBase(function testCaseMain() {
   log("Test init MobileMessageDB");
 
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
   let mmdb = newMobileMessageDB();
   let dbName = "test_mmdb_new";
   let dbVersion = 0;

From 6c20190937d43fb086a49f6dfbc01311e755276f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 07:35:26 -0800
Subject: [PATCH 113/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/9a92b00c78ba
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14651 from julienw/938207-try-2

Bug 938207 - [Dialer] Intermittent Travis Unit Test Failure: dialer/call...

========

https://hg.mozilla.org/integration/gaia-central/rev/1def6ed98d53
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 938207 - [Dialer] Intermittent Travis Unit Test Failure: dialer/call_log_db Two calls, same group, different hour Add a call: Error: timeout of 2000ms exceeded r=etienne

Really use a timeout of 20s now!
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 39ca10424b1f..cfecf392ca9d 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "28944ec8ca72535f50b097e8277ef111e3963bd7", 
+    "revision": "9a92b00c78baf10dfd85101ac26790c988918b68", 
     "repo_path": "/integration/gaia-central"
 }

From 6556a5fbd3c0ccf62f0c65ac885f5afd314586f9 Mon Sep 17 00:00:00 2001
From: Reuben Morais <reuben.morais@gmail.com>
Date: Fri, 13 Dec 2013 14:28:46 -0200
Subject: [PATCH 114/144] Bug 938889 - Remote IdleService and disable
 idle-daily notifications in content processes. r=roc

---
 dom/ipc/ContentChild.cpp           | 27 ++++++++++++++++++
 dom/ipc/ContentChild.h             |  6 ++++
 dom/ipc/ContentParent.cpp          | 45 ++++++++++++++++++++++++++++++
 dom/ipc/ContentParent.h            | 23 ++++++++++++++-
 dom/ipc/PContent.ipdl              |  7 +++++
 widget/xpwidgets/nsIdleService.cpp | 35 +++++++++++++++++------
 6 files changed, 133 insertions(+), 10 deletions(-)

diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 222afea3570f..5661dbdf0068 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -1502,6 +1502,33 @@ ContentChild::RecvNotifyPhoneStateChange(const nsString& aState)
   return true;
 }
 
+void
+ContentChild::AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS)
+{
+  MOZ_ASSERT(aObserver, "null idle observer");
+  // Make sure aObserver isn't released while we wait for the parent
+  aObserver->AddRef();
+  SendAddIdleObserver(reinterpret_cast<uint64_t>(aObserver), aIdleTimeInS);
+}
+
+void
+ContentChild::RemoveIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS)
+{
+  MOZ_ASSERT(aObserver, "null idle observer");
+  SendRemoveIdleObserver(reinterpret_cast<uint64_t>(aObserver), aIdleTimeInS);
+  aObserver->Release();
+}
+
+bool
+ContentChild::RecvNotifyIdleObserver(const uint64_t& aObserver,
+                                     const nsCString& aTopic,
+                                     const nsString& aTimeStr)
+{
+  nsIObserver* observer = reinterpret_cast<nsIObserver*>(aObserver);
+  observer->Observe(nullptr, aTopic.get(), aTimeStr.get());
+  return true;
+}
+
 bool
 ContentChild::RecvLoadAndRegisterSheet(const URIParams& aURI, const uint32_t& aType)
 {
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index 51de463523a6..a47156e2faa1 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -240,6 +240,12 @@ public:
     virtual bool RecvUnregisterSheet(const URIParams& aURI, const uint32_t& aType);
 
     virtual bool RecvNotifyPhoneStateChange(const nsString& state);
+
+    void AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS);
+    void RemoveIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS);
+    virtual bool RecvNotifyIdleObserver(const uint64_t& aObserver,
+                                        const nsCString& aTopic,
+                                        const nsString& aData);
 #ifdef ANDROID
     gfxIntSize GetScreenSize() { return mScreenSize; }
 #endif
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 1bda5817ddff..b69542c5a824 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -68,6 +68,7 @@
 #include "nsIDOMWindow.h"
 #include "nsIExternalProtocolService.h"
 #include "nsIFilePicker.h"
+#include "nsIIdleService.h"
 #include "nsIMemoryReporter.h"
 #include "nsIMozBrowserFrame.h"
 #include "nsIMutable.h"
@@ -1082,6 +1083,8 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
         obs->NotifyObservers((nsIPropertyBag2*) props, "ipc:content-shutdown", nullptr);
     }
 
+    mIdleListeners.Clear();
+
     // If the child process was terminated due to a SIGKIL, ShutDownProcess
     // might not have been called yet.  We must call it to ensure that our
     // channel is closed, etc.
@@ -3155,5 +3158,47 @@ ContentParent::RecvRecordingDeviceEvents(const nsString& aRecordingStatus,
     return true;
 }
 
+bool
+ContentParent::RecvAddIdleObserver(const uint64_t& aObserver, const uint32_t& aIdleTimeInS)
+{
+  nsresult rv;
+  nsCOMPtr<nsIIdleService> idleService =
+    do_GetService("@mozilla.org/widget/idleservice;1", &rv);
+  NS_ENSURE_SUCCESS(rv, false);
+
+  nsCOMPtr<ParentIdleListener> listener = new ParentIdleListener(this, aObserver);
+  mIdleListeners.Put(aObserver, listener);
+  idleService->AddIdleObserver(listener, aIdleTimeInS);
+  return true;
+}
+
+bool
+ContentParent::RecvRemoveIdleObserver(const uint64_t& aObserver, const uint32_t& aIdleTimeInS)
+{
+  nsresult rv;
+  nsCOMPtr<nsIIdleService> idleService =
+    do_GetService("@mozilla.org/widget/idleservice;1", &rv);
+  NS_ENSURE_SUCCESS(rv, false);
+
+  nsCOMPtr<ParentIdleListener> listener;
+  bool found = mIdleListeners.Get(aObserver, &listener);
+  if (found) {
+    mIdleListeners.Remove(aObserver);
+    idleService->RemoveIdleObserver(listener, aIdleTimeInS);
+  }
+
+  return true;
+}
+
 } // namespace dom
 } // namespace mozilla
+
+NS_IMPL_ISUPPORTS1(ParentIdleListener, nsIObserver)
+
+NS_IMETHODIMP
+ParentIdleListener::Observe(nsISupports*, const char* aTopic, const PRUnichar* aData) {
+  mozilla::unused << mParent->SendNotifyIdleObserver(mObserver,
+                                                     nsDependentCString(aTopic),
+                                                     nsDependentString(aData));
+  return NS_OK;
+}
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 5e64ed2b5561..2d22a9ba2c84 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -15,7 +15,9 @@
 #include "mozilla/LinkedList.h"
 #include "mozilla/StaticPtr.h"
 
+#include "nsDataHashtable.h"
 #include "nsFrameMessageManager.h"
+#include "nsHashKeys.h"
 #include "nsIObserver.h"
 #include "nsIThreadInternal.h"
 #include "nsIDOMGeoPositionCallback.h"
@@ -27,7 +29,7 @@ class mozIApplication;
 class nsConsoleService;
 class nsIDOMBlob;
 class nsIMemoryReporter;
-template<class KeyClass,class DataType> class nsDataHashtable;
+class ParentIdleListener;
 
 namespace mozilla {
 
@@ -510,6 +512,9 @@ private:
 
     virtual void ProcessingError(Result what) MOZ_OVERRIDE;
 
+    virtual bool RecvAddIdleObserver(const uint64_t& observerId, const uint32_t& aIdleTimeInS);
+    virtual bool RecvRemoveIdleObserver(const uint64_t& observerId, const uint32_t& aIdleTimeInS);
+
     // If you add strong pointers to cycle collected objects here, be sure to
     // release these objects in ShutDownProcess.  See the comment there for more
     // details.
@@ -559,9 +564,25 @@ private:
 
     nsRefPtr<nsConsoleService>  mConsoleService;
     nsConsoleService* GetConsoleService();
+
+    nsDataHashtable<nsUint64HashKey, nsCOMPtr<ParentIdleListener> > mIdleListeners;
 };
 
 } // namespace dom
 } // namespace mozilla
 
+class ParentIdleListener : public nsIObserver {
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  ParentIdleListener(mozilla::dom::ContentParent* aParent, uint64_t aObserver)
+    : mParent(aParent), mObserver(aObserver)
+  {}
+  virtual ~ParentIdleListener() {}
+private:
+  nsRefPtr<mozilla::dom::ContentParent> mParent;
+  uint64_t mObserver;
+};
+
 #endif
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index f18aa1d3e30d..424065129141 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -325,6 +325,11 @@ child:
     async UnregisterSheet(URIParams uri, uint32_t type);
 
     NotifyPhoneStateChange(nsString newState);
+
+    /**
+     * Notify idle observers in the child
+     */
+    NotifyIdleObserver(uint64_t observerId, nsCString topic, nsString str);
 parent:
     /**
      * Tell the content process some attributes of itself.  This is
@@ -502,6 +507,8 @@ parent:
                                 bool isAudio,
                                 bool isVideo);
 
+    AddIdleObserver(uint64_t observerId, uint32_t idleTimeInS);
+    RemoveIdleObserver(uint64_t observerId, uint32_t idleTimeInS);
 both:
      AsyncMessage(nsString aMessage, ClonedMessageData aData,
                   CpowEntry[] aCpows, Principal aPrincipal);
diff --git a/widget/xpwidgets/nsIdleService.cpp b/widget/xpwidgets/nsIdleService.cpp
index a3af403c7ca1..d1184baefc39 100644
--- a/widget/xpwidgets/nsIdleService.cpp
+++ b/widget/xpwidgets/nsIdleService.cpp
@@ -11,9 +11,11 @@
 #include "nsIServiceManager.h"
 #include "nsDebug.h"
 #include "nsCOMArray.h"
+#include "nsXULAppAPI.h"
 #include "prinrval.h"
 #include "prlog.h"
 #include "prtime.h"
+#include "mozilla/dom/ContentChild.h"
 #include "mozilla/Services.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Telemetry.h"
@@ -397,8 +399,10 @@ nsIdleService::nsIdleService() : mCurrentlySetToTimeoutAt(TimeStamp()),
 #endif
   MOZ_ASSERT(!gIdleService);
   gIdleService = this;
-  mDailyIdle = new nsIdleServiceDaily(this);
-  mDailyIdle->Init();
+  if (XRE_GetProcessType() == GeckoProcessType_Default) {
+    mDailyIdle = new nsIdleServiceDaily(this);
+    mDailyIdle->Init();
+  }
 }
 
 nsIdleService::~nsIdleService()
@@ -417,20 +421,26 @@ NS_IMPL_ISUPPORTS2(nsIdleService, nsIIdleService, nsIIdleServiceInternal)
 NS_IMETHODIMP
 nsIdleService::AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS)
 {
+  NS_ENSURE_ARG_POINTER(aObserver);
+  // We don't accept idle time at 0, and we can't handle idle time that are too
+  // high either - no more than ~136 years.
+  NS_ENSURE_ARG_RANGE(aIdleTimeInS, 1, (UINT32_MAX / 10) - 1);
+
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    dom::ContentChild* cpc = dom::ContentChild::GetSingleton();
+    cpc->AddIdleObserver(aObserver, aIdleTimeInS);
+    return NS_OK;
+  }
+
   PR_LOG(sLog, PR_LOG_DEBUG,
-         ("idleService: Register idle observer %x for %d seconds",
-          aObserver, aIdleTimeInS));
+       ("idleService: Register idle observer %x for %d seconds",
+        aObserver, aIdleTimeInS));
 #ifdef MOZ_WIDGET_ANDROID
   __android_log_print(ANDROID_LOG_INFO, "IdleService",
                       "Register idle observer %x for %d seconds",
                       aObserver, aIdleTimeInS);
 #endif
 
-  NS_ENSURE_ARG_POINTER(aObserver);
-  // We don't accept idle time at 0, and we can't handle idle time that are too
-  // high either - no more than ~136 years.
-  NS_ENSURE_ARG_RANGE(aIdleTimeInS, 1, (UINT32_MAX / 10) - 1);
-
   // Put the time + observer in a struct we can keep:
   IdleListener listener(aObserver, aIdleTimeInS);
 
@@ -474,6 +484,13 @@ nsIdleService::RemoveIdleObserver(nsIObserver* aObserver, uint32_t aTimeInS)
 
   NS_ENSURE_ARG_POINTER(aObserver);
   NS_ENSURE_ARG(aTimeInS);
+
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    dom::ContentChild* cpc = dom::ContentChild::GetSingleton();
+    cpc->RemoveIdleObserver(aObserver, aTimeInS);
+    return NS_OK;
+  }
+
   IdleListener listener(aObserver, aTimeInS);
 
   // Find the entry and remove it, if it was the last entry, we just let the

From 0d0234372027710d4783bbf112fe49caafa35a81 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 08:40:23 -0800
Subject: [PATCH 115/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/aed25a1b6915
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Merge pull request #14419 from fcampo/jshint-errors

[Bug 946773] JShint errors (r=arcturus)

========

https://hg.mozilla.org/integration/gaia-central/rev/7042c6be0826
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Fix some JShint errors
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index cfecf392ca9d..1929ed741554 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "9a92b00c78baf10dfd85101ac26790c988918b68", 
+    "revision": "aed25a1b6915f94d81f766c51d71df557019ae3e", 
     "repo_path": "/integration/gaia-central"
 }

From 9abce82c28b49b618378f5c8b98b587223e1ccad Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Fri, 6 Dec 2013 17:35:13 +0800
Subject: [PATCH 116/144] Bug 768441 - Part 1: Support Stored Message Waiting
 Indicators. r=vyang

---
 dom/system/gonk/RadioInterfaceLayer.js |  9 ++-
 dom/system/gonk/ril_consts.js          |  2 +
 dom/system/gonk/ril_worker.js          | 99 ++++++++++++++++++++++++++
 3 files changed, 105 insertions(+), 5 deletions(-)

diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index bc8c57a45dc1..94c36dbc29e4 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -1258,6 +1258,10 @@ RadioInterface.prototype = {
       case "iccmbdn":
         this.handleIccMbdn(message);
         break;
+      case "iccmwis":
+        gMessageManager.sendVoicemailMessage("RIL:VoicemailNotification",
+                                             this.clientId, message.mwi);
+        break;
       case "USSDReceived":
         if (DEBUG) this.debug("USSDReceived " + JSON.stringify(message));
         this.handleUSSDReceived(message);
@@ -2104,11 +2108,6 @@ RadioInterface.prototype = {
       return true;
     }
 
-    // TODO: Bug #768441
-    // For now we don't store indicators persistently. When the mwi.discard
-    // flag is false, we'll need to persist the indicator to EFmwis.
-    // See TS 23.040 9.2.3.24.2
-
     let mwi = message.mwi;
     if (mwi) {
       mwi.returnNumber = message.sender;
diff --git a/dom/system/gonk/ril_consts.js b/dom/system/gonk/ril_consts.js
index cf5efc67ec23..c4a68eb2faaa 100644
--- a/dom/system/gonk/ril_consts.js
+++ b/dom/system/gonk/ril_consts.js
@@ -1206,6 +1206,7 @@ this.GECKO_ICC_SERVICES = {
     PNN: 51,
     OPL: 52,
     MDN: 53,
+    MWIS: 54,
     SPDI: 56
   },
   usim: {
@@ -1221,6 +1222,7 @@ this.GECKO_ICC_SERVICES = {
     PNN: 45,
     OPL: 46,
     MDN: 47,
+    MWIS: 48,
     SPDI: 51
   },
   ruim: {
diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index a2aec4132c02..ff6b04343b8c 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -4206,6 +4206,11 @@ let RIL = {
 
       this.sendChromeMessage(message);
 
+      // Update MWI Status into ICC if present.
+      if (message.mwi && ICCUtilsHelper.isICCServiceAvailable("MWIS")) {
+        SimRecordHelper.updateMWIS(message.mwi);
+      }
+
       // We will acknowledge receipt of the SMS after we try to store it
       // in the database.
       return MOZ_FCS_WAIT_FOR_EXPLICIT_ACK;
@@ -10937,6 +10942,7 @@ let ICCFileHelper = {
         return EF_PATH_MF_SIM + EF_PATH_DF_TELECOM;
       case ICC_EF_AD:
       case ICC_EF_MBDN:
+      case ICC_EF_MWIS:
       case ICC_EF_PLMNsel:
       case ICC_EF_SPN:
       case ICC_EF_SPDI:
@@ -10961,6 +10967,7 @@ let ICCFileHelper = {
       case ICC_EF_AD:
       case ICC_EF_FDN:
       case ICC_EF_MBDN:
+      case ICC_EF_MWIS:
       case ICC_EF_UST:
       case ICC_EF_MSISDN:
       case ICC_EF_SPN:
@@ -11916,6 +11923,13 @@ let SimRecordHelper = {
         if (DEBUG) debug("MDN: MDN service is not available");
       }
 
+      if (ICCUtilsHelper.isICCServiceAvailable("MWIS")) {
+        if (DEBUG) debug("MWIS: MWIS is available");
+        this.readMWIS();
+      } else {
+        if (DEBUG) debug("MWIS: MWIS is not available");
+      }
+
       if (ICCUtilsHelper.isICCServiceAvailable("SPDI")) {
         if (DEBUG) debug("SPDI: SPDI available.");
         this.readSPDI();
@@ -11985,6 +11999,91 @@ let SimRecordHelper = {
                                    callback: callback.bind(this)});
   },
 
+  /**
+   * Read ICC MWIS. (Message Waiting Indication Status)
+   *
+   * @see TS 31.102, clause 4.2.63 for USIM and TS 51.011, clause 10.3.45 for SIM.
+   */
+  readMWIS: function readMWIS() {
+    function callback(options) {
+      let strLen = Buf.readInt32();
+      // Each octet is encoded into two chars.
+      let octetLen = strLen / 2;
+      let mwis = GsmPDUHelper.readHexOctetArray(octetLen);
+      Buf.readStringDelimiter(strLen);
+      if (!mwis) {
+        return;
+      }
+      RIL.iccInfoPrivate.mwis = mwis; //Keep raw MWIS for updateMWIS()
+
+      let mwi = {};
+      // b8 b7 B6 b5 b4 b3 b2 b1   4.2.63, TS 31.102 version 11.6.0
+      //  |  |  |  |  |  |  |  |__ Voicemail
+      //  |  |  |  |  |  |  |_____ Fax
+      //  |  |  |  |  |  |________ Electronic Mail
+      //  |  |  |  |  |___________ Other
+      //  |  |  |  |______________ Videomail
+      //  |__|__|_________________ RFU
+      mwi.active = ((mwis[0] & 0x01) != 0);
+
+      if (mwi.active) {
+        // In TS 23.040 msgCount is in the range from 0 to 255.
+        // The value 255 shall be taken to mean 255 or greater.
+        //
+        // However, There is no definition about 0 when MWI is active.
+        //
+        // Normally, when mwi is active, the msgCount must be larger than 0.
+        // Refer to other reference phone,
+        // 0 is usually treated as UNKNOWN for storing 2nd level MWI status (DCS).
+        mwi.msgCount = (mwis[1] === 0) ? GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN
+                                       : mwis[1];
+      } else {
+        mwi.msgCount = 0;
+      }
+
+      RIL.sendChromeMessage({ rilMessageType: "iccmwis",
+                              mwi: mwi });
+    }
+
+    ICCIOHelper.loadLinearFixedEF({ fileId: ICC_EF_MWIS,
+                                    recordNumber: 1, // Get 1st Subscriber Profile.
+                                    callback: callback });
+  },
+
+  /**
+   * Update ICC MWIS. (Message Waiting Indication Status)
+   *
+   * @see TS 31.102, clause 4.2.63 for USIM and TS 51.011, clause 10.3.45 for SIM.
+   */
+  updateMWIS: function updateMWIS(mwi) {
+    if (!RIL.iccInfoPrivate.mwis) {
+      return;
+    }
+
+    function dataWriter(recordSize) {
+      let mwis = RIL.iccInfoPrivate.mwis;
+
+      let msgCount =
+          (mwi.msgCount === GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN) ? 0 : mwi.msgCount;
+
+      [mwis[0], mwis[1]] = (mwi.active) ? [(mwis[0] | 0x01), msgCount]
+                                        : [(mwis[0] & 0xFE), 0];
+
+      let strLen = recordSize * 2;
+      Buf.writeInt32(strLen);
+
+      for (let i = 0; i < mwis.length; i++) {
+        GsmPDUHelper.writeHexOctet(mwis[i]);
+      }
+
+      Buf.writeStringDelimiter(strLen);
+    }
+
+    ICCIOHelper.updateLinearFixedEF({ fileId: ICC_EF_MWIS,
+                                      recordNumber: 1, // Update 1st Subscriber Profile.
+                                      dataWriter: dataWriter });
+  },
+
   /**
    * Read the SPDI (Service Provider Display Information) from the (U)SIM.
    *

From d0079ab03b49612557029f14c90d5dc5aa8e2a73 Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Tue, 10 Dec 2013 19:24:27 +0800
Subject: [PATCH 117/144] Bug 768441 - Part 2: Test Case to Verify the Access
 of EF_MWIS. r=vyang

---
 dom/system/gonk/tests/test_ril_worker_icc.js | 177 ++++++++++++++++++-
 1 file changed, 176 insertions(+), 1 deletion(-)

diff --git a/dom/system/gonk/tests/test_ril_worker_icc.js b/dom/system/gonk/tests/test_ril_worker_icc.js
index ee1b1c44c657..f4cd767b2c73 100644
--- a/dom/system/gonk/tests/test_ril_worker_icc.js
+++ b/dom/system/gonk/tests/test_ril_worker_icc.js
@@ -2330,6 +2330,10 @@ add_test(function test_reading_optional_efs() {
       testEf.splice(testEf.indexOf("MDN"), 1);
     };
 
+    record.readMWIS = function fakeReadMWIS() {
+      testEf.splice(testEf.indexOf("MWIS"), 1);
+    };
+
     io.loadTransparentEF = function fakeLoadTransparentEF(options) {
       // Write data size
       buf.writeInt32(sst.length * 2);
@@ -2356,7 +2360,7 @@ add_test(function test_reading_optional_efs() {
   }
 
   // TODO: Add all necessary optional EFs eventually
-  let supportedEf = ["MSISDN", "MDN"];
+  let supportedEf = ["MSISDN", "MDN", "MWIS"];
   ril.appType = CARD_APPTYPE_SIM;
   do_test(buildSST(supportedEf), supportedEf);
   ril.appType = CARD_APPTYPE_USIM;
@@ -2435,3 +2439,174 @@ add_test(function test_fetch_icc_recodes() {
 
   run_next_test();
 });
+
+add_test(function test_read_mwis() {
+  let worker = newUint8Worker();
+  let helper = worker.GsmPDUHelper;
+  let recordHelper = worker.SimRecordHelper;
+  let buf    = worker.Buf;
+  let io     = worker.ICCIOHelper;
+  let mwisData;
+  let postedMessage;
+
+  worker.postMessage = function fakePostMessage(message) {
+    postedMessage = message;
+  };
+
+  io.loadLinearFixedEF = function fakeLoadLinearFixedEF(options) {
+    if (mwisData) {
+      // Write data size
+      buf.writeInt32(mwisData.length * 2);
+
+      // Write MWIS
+      for (let i = 0; i < mwisData.length; i++) {
+        helper.writeHexOctet(mwisData[i]);
+      }
+
+      // Write string delimiter
+      buf.writeStringDelimiter(mwisData.length * 2);
+
+      options.recordSize = mwisData.length;
+      if (options.callback) {
+        options.callback(options);
+      }
+    } else {
+      do_print("mwisData[] is not set.");
+    }
+  };
+
+  function buildMwisData(isActive, msgCount) {
+    if (msgCount < 0 || msgCount === GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN) {
+      msgCount = 0;
+    } else if (msgCount > 255) {
+      msgCount = 255;
+    }
+
+    mwisData =  [ (isActive) ? 0x01 : 0x00,
+                  msgCount,
+                  0xFF, 0xFF, 0xFF ];
+  }
+
+  function do_test(isActive, msgCount) {
+    buildMwisData(isActive, msgCount);
+    recordHelper.readMWIS();
+
+    do_check_eq("iccmwis", postedMessage.rilMessageType);
+    do_check_eq(isActive, postedMessage.mwi.active);
+    do_check_eq((isActive) ? msgCount : 0, postedMessage.mwi.msgCount);
+  }
+
+  do_test(true, GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN);
+  do_test(true, 1);
+  do_test(true, 255);
+
+  do_test(false, 0);
+  do_test(false, 255); // Test the corner case when mwi is disable with incorrect msgCount.
+
+  run_next_test();
+});
+
+add_test(function test_update_mwis() {
+  let worker = newUint8Worker();
+  let pduHelper = worker.GsmPDUHelper;
+  let ril = worker.RIL;
+  ril.appType = CARD_APPTYPE_USIM;
+  ril.iccInfoPrivate.mwis = [0x00, 0x00, 0x00, 0x00, 0x00];
+  let recordHelper = worker.SimRecordHelper;
+  let buf = worker.Buf;
+  let ioHelper = worker.ICCIOHelper;
+  let recordSize = ril.iccInfoPrivate.mwis.length;
+  let recordNum = 1;
+
+  ioHelper.updateLinearFixedEF = function (options) {
+    options.pathId = worker.ICCFileHelper.getEFPath(options.fileId);
+    options.command = ICC_COMMAND_UPDATE_RECORD;
+    options.p1 = options.recordNumber;
+    options.p2 = READ_RECORD_ABSOLUTE_MODE;
+    options.p3 = recordSize;
+    ril.iccIO(options);
+  };
+
+  function do_test(isActive, count) {
+    let mwis = ril.iccInfoPrivate.mwis;
+    let isUpdated = false;
+
+    function buildMwisData() {
+      let result = mwis.slice(0);
+      result[0] = isActive? (mwis[0] | 0x01) : (mwis[0] & 0xFE);
+      result[1] = (count === GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN) ? 0 : count;
+
+      return result;
+    }
+
+    buf.sendParcel = function () {
+      isUpdated = true;
+
+      // Request Type.
+      do_check_eq(this.readInt32(), REQUEST_SIM_IO);
+
+      // Token : we don't care
+      this.readInt32();
+
+      // command.
+      do_check_eq(this.readInt32(), ICC_COMMAND_UPDATE_RECORD);
+
+      // fileId.
+      do_check_eq(this.readInt32(), ICC_EF_MWIS);
+
+      // pathId.
+      do_check_eq(this.readString(),
+                  EF_PATH_MF_SIM + ((ril.appType === CARD_APPTYPE_USIM) ? EF_PATH_ADF_USIM : EF_PATH_DF_GSM));
+
+      // p1.
+      do_check_eq(this.readInt32(), recordNum);
+
+      // p2.
+      do_check_eq(this.readInt32(), READ_RECORD_ABSOLUTE_MODE);
+
+      // p3.
+      do_check_eq(this.readInt32(), recordSize);
+
+      // data.
+      let strLen = this.readInt32();
+      do_check_eq(recordSize * 2, strLen);
+      let expectedMwis = buildMwisData();
+      for (let i = 0; i < recordSize; i++) {
+        do_check_eq(expectedMwis[i], pduHelper.readHexOctet());
+      }
+      this.readStringDelimiter(strLen);
+
+      // pin2.
+      do_check_eq(this.readString(), null);
+
+      if (!worker.RILQUIRKS_V5_LEGACY) {
+        // AID. Ignore because it's from modem.
+        this.readInt32();
+      }
+    };
+
+    do_check_false(isUpdated);
+
+    recordHelper.updateMWIS({ active: isActive,
+                              msgCount: count });
+
+    do_check_true((ril.iccInfoPrivate.mwis) ? isUpdated : !isUpdated);
+  }
+
+  do_test(true, GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN);
+  do_test(true, 1);
+  do_test(true, 255);
+
+  do_test(false, 0);
+
+  // Test if Path ID is correct for SIM.
+  ril.appType = CARD_APPTYPE_SIM;
+  do_test(false, 0);
+
+  // Test if loadLinearFixedEF() is not invoked in updateMWIS() when
+  // EF_MWIS is not loaded/available.
+  delete ril.iccInfoPrivate.mwis;
+  do_test(false, 0);
+
+  run_next_test();
+});

From dc7950b5b26e6f35476a476136abce4c99c21285 Mon Sep 17 00:00:00 2001
From: Chuck Lee <chulee@mozilla.com>
Date: Wed, 11 Dec 2013 12:46:16 +0800
Subject: [PATCH 118/144] Bug 947814 - 0001. Assign length of data. r=vicamo

---
 dom/wappush/src/gonk/CpPduHelper.jsm   | 2 +-
 dom/wappush/src/gonk/WapPushManager.js | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/dom/wappush/src/gonk/CpPduHelper.jsm b/dom/wappush/src/gonk/CpPduHelper.jsm
index 5f4bb38f209f..728a31e32d28 100644
--- a/dom/wappush/src/gonk/CpPduHelper.jsm
+++ b/dom/wappush/src/gonk/CpPduHelper.jsm
@@ -185,9 +185,9 @@ this.Authenticator = {
       checked: false,
       sec: AUTH_SEC_TYPE[sec],
       mac: mac.toUpperCase(),
-      dataLength: wbxml.length,
       data: wbxml
     };
+    authInfo.data.length = wbxml.length;
 
     switch (authInfo.sec) {
       case "NETWPIN":
diff --git a/dom/wappush/src/gonk/WapPushManager.js b/dom/wappush/src/gonk/WapPushManager.js
index 4821767af30b..f52ba7a503fc 100644
--- a/dom/wappush/src/gonk/WapPushManager.js
+++ b/dom/wappush/src/gonk/WapPushManager.js
@@ -123,6 +123,7 @@ this.WapPushManager = {
         contentType: contentType,
         content: data.array
       };
+      msg.content.length = data.array.length;
     }
 
     let sender = PhoneNumberUtils.normalize(options.sourceAddress, false);

From cf45d3539cdc9901fa9ad57d9fcaca973f5b12a1 Mon Sep 17 00:00:00 2001
From: Chuck Lee <chulee@mozilla.com>
Date: Wed, 11 Dec 2013 12:46:19 +0800
Subject: [PATCH 119/144] Bug 947814 - 0002. Test case. r=vicamo

---
 dom/wappush/tests/test_cp_pdu_helper.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dom/wappush/tests/test_cp_pdu_helper.js b/dom/wappush/tests/test_cp_pdu_helper.js
index 0463dd2048ab..7a3fa5fa1e64 100644
--- a/dom/wappush/tests/test_cp_pdu_helper.js
+++ b/dom/wappush/tests/test_cp_pdu_helper.js
@@ -14,6 +14,7 @@ function test_parser(rawDataArray, contentType, expectResult) {
   let msg = CP.PduHelper.parse(data, contentType);
   do_check_eq(msg.contentType, expectResult.contentType);
   do_check_eq(msg.content, expectResult.content);
+  do_check_eq(msg.content.length, expectResult.content.length);
 }
 
 function test_hmac(rawDataArray, mac, key, expectResult) {
@@ -21,7 +22,7 @@ function test_hmac(rawDataArray, mac, key, expectResult) {
     return key;
   });
   do_check_eq(authInfo.data, rawDataArray);
-  do_check_eq(authInfo.dataLength, rawDataArray.length);
+  do_check_eq(authInfo.data.length, rawDataArray.length);
   do_check_eq(authInfo.checked, expectResult.checked);
   do_check_eq(authInfo.pass, expectResult.pass);
 }

From 8fa7a3a3c35d51ce514c03ab24f34edc2beee7dc Mon Sep 17 00:00:00 2001
From: Ghislain Lacroix <aus@mozilla.com>
Date: Fri, 13 Dec 2013 11:46:22 -0500
Subject: [PATCH 120/144] Bug 948287 - [Download API] Accessing startTime
 attribute at download start fires NS_ERROR_UNEXPECTED in emulator. r=fabrice

---
 dom/downloads/src/DownloadsAPI.js | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/dom/downloads/src/DownloadsAPI.js b/dom/downloads/src/DownloadsAPI.js
index 56586bb99698..a87ca1d44457 100644
--- a/dom/downloads/src/DownloadsAPI.js
+++ b/dom/downloads/src/DownloadsAPI.js
@@ -198,6 +198,7 @@ function createDOMDownloadObject(aWindow, aDownload) {
 
 function DOMDownloadImpl() {
   debug("DOMDownloadImpl constructor ");
+
   this.wrappedJSObject = this;
   this.totalBytes = 0;
   this.currentBytes = 0;
@@ -205,9 +206,11 @@ function DOMDownloadImpl() {
   this.path = null;
   this.state = "stopped";
   this.contentType = null;
-  this.startTime = Date.now();
   this.error = null;
 
+  /* fields that require getters/setters */
+  this._startTime = new Date();
+
   /* private fields */
   this.id = null;
 }
@@ -244,6 +247,19 @@ DOMDownloadImpl.prototype = {
     return this.__DOM_IMPL__.getEventHandler("onstatechange");
   },
 
+  get startTime() {
+    return this._startTime;
+  },
+
+  set startTime(aStartTime) {
+    if (aStartTime instanceof Date) {
+      this._startTime = aStartTime;
+    }
+    else {
+      this._startTime = new Date(aStartTime);
+    }
+  },
+
   _init: function(aWindow, aDownload) {
     this._window = aWindow;
     this.id = aDownload.id;

From 9212f601833798796922571cc68f6e9a339e994d Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Thu, 12 Dec 2013 15:59:34 +0800
Subject: [PATCH 121/144] Bug 949318 - B2G SMS: Class 2 SMS is not working
 after ICCRecordHelper.readSMS() was refactored into SimRecordHelper. r=vyang

---
 dom/system/gonk/ril_worker.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index ff6b04343b8c..6dec70f22f0a 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -6168,7 +6168,7 @@ RIL[UNSOLICITED_RESPONSE_NEW_SMS_STATUS_REPORT] = function UNSOLICITED_RESPONSE_
 RIL[UNSOLICITED_RESPONSE_NEW_SMS_ON_SIM] = function UNSOLICITED_RESPONSE_NEW_SMS_ON_SIM(length) {
   let recordNumber = Buf.readInt32List()[0];
 
-  ICCRecordHelper.readSMS(
+  SimRecordHelper.readSMS(
     recordNumber,
     function onsuccess(message) {
       if (message && message.simStatus === 3) { //New Unread SMS

From afaa2bac0c52ce336b595f537f93c2b0aa8f10ba Mon Sep 17 00:00:00 2001
From: Ralph Giles <giles@mozilla.com>
Date: Thu, 12 Dec 2013 15:08:09 -0800
Subject: [PATCH 122/144] Bug 949713 - Remove unused typedef to fix problems
 with unified builds on some systems. r=cpearce

---
 media/libvpx/unified.patch           | 13 +++++++++++++
 media/libvpx/vp8/common/loopfilter.c |  2 --
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/media/libvpx/unified.patch b/media/libvpx/unified.patch
index 13501ae2dee1..f4eddf66f508 100644
--- a/media/libvpx/unified.patch
+++ b/media/libvpx/unified.patch
@@ -67,3 +67,16 @@ index 16a735c..0387a71 100644
  #endif
 +
 +#endif
+diff --git a/media/libvpx/vp8/common/loopfilter.c b/media/libvpx/vp8/common/loopfilter.c
+index 19857a7..3c0fa63 100644
+--- a/media/libvpx/vp8/common/loopfilter.c
++++ b/media/libvpx/vp8/common/loopfilter.c
+@@ -15,8 +15,6 @@
+ #include "onyxc_int.h"
+ #include "vpx_mem/vpx_mem.h"
+ 
+-typedef unsigned char uc;
+-
+ static void lf_init_lut(loop_filter_info_n *lfi)
+ {
+     int filt_lvl;
diff --git a/media/libvpx/vp8/common/loopfilter.c b/media/libvpx/vp8/common/loopfilter.c
index 19857a7e9fbd..3c0fa636f352 100644
--- a/media/libvpx/vp8/common/loopfilter.c
+++ b/media/libvpx/vp8/common/loopfilter.c
@@ -15,8 +15,6 @@
 #include "onyxc_int.h"
 #include "vpx_mem/vpx_mem.h"
 
-typedef unsigned char uc;
-
 static void lf_init_lut(loop_filter_info_n *lfi)
 {
     int filt_lvl;

From 71bbbd7eb26eaeeb779ad55379bb54e6db9c568c Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:31:35 +0100
Subject: [PATCH 123/144] Bug 929513 - Remove unused #include statements
 r=nical

---
 gfx/layers/client/ClientTiledThebesLayer.cpp | 1 -
 gfx/layers/client/TiledContentClient.h       | 1 -
 gfx/layers/composite/CompositableHost.h      | 1 -
 gfx/layers/composite/ThebesLayerComposite.h  | 1 -
 gfx/layers/composite/TiledContentHost.h      | 1 -
 5 files changed, 5 deletions(-)

diff --git a/gfx/layers/client/ClientTiledThebesLayer.cpp b/gfx/layers/client/ClientTiledThebesLayer.cpp
index 2db6aa600b54..86e5214b47f9 100644
--- a/gfx/layers/client/ClientTiledThebesLayer.cpp
+++ b/gfx/layers/client/ClientTiledThebesLayer.cpp
@@ -8,7 +8,6 @@
 #include "ClientLayerManager.h"         // for ClientLayerManager, etc
 #include "gfx3DMatrix.h"                // for gfx3DMatrix
 #include "gfxPlatform.h"                // for gfxPlatform
-#include "gfxPoint.h"                   // for gfxSize
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/gfx/BaseSize.h"       // for BaseSize
diff --git a/gfx/layers/client/TiledContentClient.h b/gfx/layers/client/TiledContentClient.h
index 37637efe195c..e92f36e5eff1 100644
--- a/gfx/layers/client/TiledContentClient.h
+++ b/gfx/layers/client/TiledContentClient.h
@@ -14,7 +14,6 @@
 #include "Units.h"                      // for CSSPoint
 #include "gfx3DMatrix.h"                // for gfx3DMatrix
 #include "gfxTypes.h"
-#include "gfxPoint.h"                   // for gfxSize
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr
 #include "mozilla/layers/CompositableClient.h"  // for CompositableClient
diff --git a/gfx/layers/composite/CompositableHost.h b/gfx/layers/composite/CompositableHost.h
index 7e7435c6f6b4..aa558fef26f3 100644
--- a/gfx/layers/composite/CompositableHost.h
+++ b/gfx/layers/composite/CompositableHost.h
@@ -8,7 +8,6 @@
 
 #include <stdint.h>                     // for uint64_t
 #include <stdio.h>                      // for FILE
-#include "gfxPoint.h"                   // for gfxSize
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
diff --git a/gfx/layers/composite/ThebesLayerComposite.h b/gfx/layers/composite/ThebesLayerComposite.h
index 74d7f6b9dcd7..3375c6b7ea01 100644
--- a/gfx/layers/composite/ThebesLayerComposite.h
+++ b/gfx/layers/composite/ThebesLayerComposite.h
@@ -7,7 +7,6 @@
 #define GFX_ThebesLayerComposite_H
 
 #include "Layers.h"                     // for Layer (ptr only), etc
-#include "gfxPoint.h"                   // for gfxSize
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr
diff --git a/gfx/layers/composite/TiledContentHost.h b/gfx/layers/composite/TiledContentHost.h
index 163a36da1537..3928a848bc0f 100644
--- a/gfx/layers/composite/TiledContentHost.h
+++ b/gfx/layers/composite/TiledContentHost.h
@@ -12,7 +12,6 @@
 #include "ContentHost.h"                // for ContentHost
 #include "TiledLayerBuffer.h"           // for TiledLayerBuffer, etc
 #include "CompositableHost.h"
-#include "gfxPoint.h"                   // for gfxSize
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr

From eaa77f044b88471058d60118ddc20a44d7c9e4ca Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:31:53 +0100
Subject: [PATCH 124/144] Bug 929513 - Change gfxSize references to gfx::Size
 r=nical

---
 gfx/layers/Layers.cpp                            |  3 ++-
 gfx/layers/composite/AsyncCompositionManager.cpp |  2 +-
 gfx/layers/composite/TiledContentHost.cpp        |  2 +-
 image/src/RasterImage.cpp                        | 12 ++++++------
 image/src/RasterImage.h                          |  6 +++---
 5 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 2a43910515c1..5fffb03188e6 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -16,6 +16,7 @@
 #include "ReadbackLayer.h"              // for ReadbackLayer
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxUtils.h"                   // for gfxUtils, etc
+#include "gfx2DGlue.h"
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "mozilla/Telemetry.h"          // for Accumulate
 #include "mozilla/TelemetryHistogramEnums.h"
@@ -509,7 +510,7 @@ Layer::SnapTransform(const gfx3DMatrix& aTransform,
   gfx3DMatrix result;
   if (mManager->IsSnappingEffectiveTransforms() &&
       aTransform.Is2D(&matrix2D) &&
-      gfxSize(1.0, 1.0) <= aSnapRect.Size() &&
+      gfx::Size(1.0, 1.0) <= ToSize(aSnapRect.Size()) &&
       matrix2D.PreservesAxisAlignedRectangles()) {
     gfxPoint transformedTopLeft = matrix2D.Transform(aSnapRect.TopLeft());
     transformedTopLeft.Round();
diff --git a/gfx/layers/composite/AsyncCompositionManager.cpp b/gfx/layers/composite/AsyncCompositionManager.cpp
index d92a08f2eb46..6cbb354ad29f 100644
--- a/gfx/layers/composite/AsyncCompositionManager.cpp
+++ b/gfx/layers/composite/AsyncCompositionManager.cpp
@@ -703,7 +703,7 @@ AsyncCompositionManager::TransformScrollableLayer(Layer* aLayer)
   }
   oldTransform.Translate(overscrollTranslation);
 
-  gfxSize underZoomScale(1.0f, 1.0f);
+  gfx::Size underZoomScale(1.0f, 1.0f);
   if (mContentRect.width * userZoom.scale < metrics.mCompositionBounds.width) {
     underZoomScale.width = (mContentRect.width * userZoom.scale) /
       metrics.mCompositionBounds.width;
diff --git a/gfx/layers/composite/TiledContentHost.cpp b/gfx/layers/composite/TiledContentHost.cpp
index cb3c4188868b..730ebe98dcc2 100644
--- a/gfx/layers/composite/TiledContentHost.cpp
+++ b/gfx/layers/composite/TiledContentHost.cpp
@@ -228,7 +228,7 @@ TiledContentHost::RenderLayerBuffer(TiledLayerBufferComposite& aLayerBuffer,
     return;
   }
   float resolution = aLayerBuffer.GetResolution();
-  gfxSize layerScale(1, 1);
+  gfx::Size layerScale(1, 1);
   // We assume that the current frame resolution is the one used in our primary
   // layer buffer. Compensate for a changing frame resolution.
   if (aLayerBuffer.GetFrameResolution() != mVideoMemoryTiledBuffer.GetFrameResolution()) {
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index f224c362a909..b5aad0276352 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -175,7 +175,7 @@ DiscardingEnabled()
 class ScaleRequest
 {
 public:
-  ScaleRequest(RasterImage* aImage, const gfxSize& aScale, imgFrame* aSrcFrame)
+  ScaleRequest(RasterImage* aImage, const gfx::Size& aScale, imgFrame* aSrcFrame)
     : scale(aScale)
     , dstLocked(false)
     , done(false)
@@ -267,7 +267,7 @@ public:
   nsRefPtr<gfxImageSurface> dstSurface;
 
   // Below are the values that may be touched on the scaling thread.
-  gfxSize scale;
+  gfx::Size scale;
   uint8_t* srcData;
   uint8_t* dstData;
   nsIntRect srcRect;
@@ -318,7 +318,7 @@ private: /* members */
 class ScaleRunner : public nsRunnable
 {
 public:
-  ScaleRunner(RasterImage* aImage, const gfxSize& aScale, imgFrame* aSrcFrame)
+  ScaleRunner(RasterImage* aImage, const gfx::Size& aScale, imgFrame* aSrcFrame)
   {
     nsAutoPtr<ScaleRequest> request(new ScaleRequest(aImage, aScale, aSrcFrame));
 
@@ -2420,7 +2420,7 @@ RasterImage::SyncDecode()
 }
 
 bool
-RasterImage::CanQualityScale(const gfxSize& scale)
+RasterImage::CanQualityScale(const gfx::Size& scale)
 {
   // If target size is 1:1 with original, don't scale.
   if (scale.width == 1.0 && scale.height == 1.0)
@@ -2438,7 +2438,7 @@ RasterImage::CanQualityScale(const gfxSize& scale)
 
 bool
 RasterImage::CanScale(GraphicsFilter aFilter,
-                      gfxSize aScale, uint32_t aFlags)
+                      gfx::Size aScale, uint32_t aFlags)
 {
 // The high-quality scaler requires Skia.
 #ifdef MOZ_ENABLE_SKIA
@@ -2514,7 +2514,7 @@ RasterImage::DrawWithPreDownscaleIfNeeded(imgFrame *aFrame,
   gfxMatrix userSpaceToImageSpace = aUserSpaceToImageSpace;
   gfxMatrix imageSpaceToUserSpace = aUserSpaceToImageSpace;
   imageSpaceToUserSpace.Invert();
-  gfxSize scale = imageSpaceToUserSpace.ScaleFactors(true);
+  gfx::Size scale = ToSize(imageSpaceToUserSpace.ScaleFactors(true));
   nsIntRect subimage = aSubimage;
 
   if (CanScale(aFilter, scale, aFlags)) {
diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h
index da5747e8e739..221fc75e7206 100644
--- a/image/src/RasterImage.h
+++ b/image/src/RasterImage.h
@@ -704,8 +704,8 @@ private: // data
   bool     IsDecodeFinished();
   TimeStamp mDrawStartTime;
 
-  inline bool CanQualityScale(const gfxSize& scale);
-  inline bool CanScale(GraphicsFilter aFilter, gfxSize aScale, uint32_t aFlags);
+  inline bool CanQualityScale(const gfx::Size& scale);
+  inline bool CanScale(GraphicsFilter aFilter, gfx::Size aScale, uint32_t aFlags);
 
   struct ScaleResult
   {
@@ -713,7 +713,7 @@ private: // data
      : status(SCALE_INVALID)
     {}
 
-    gfxSize scale;
+    gfx::Size scale;
     nsAutoPtr<imgFrame> frame;
     ScaleStatus status;
   };

From e437dfc935f8cb5e4419240d3bce1d3b11d3e138 Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:31:57 +0100
Subject: [PATCH 125/144] Bug 929513 - Add YCbCrUtils class and change
 gfxIntSize in BasicCompositor r=nical

The purpose of this patch is to replace usages of gfxIntSize with
gfx::IntSize in BasicCompositor.

The new class YCbCrUtils has two methods ported from gfxUtils in thebes.
BasicCompositor now uses these methods instead of the ones in gfxUtils.
Also changed gfxIntSize to gfx::IntSize and gfxImageFormat to
gfx::SurfaceFormat.
---
 gfx/layers/basic/BasicCompositor.cpp |  17 ++-
 gfx/ycbcr/YCbCrUtils.cpp             | 156 +++++++++++++++++++++++++++
 gfx/ycbcr/YCbCrUtils.h               |  30 ++++++
 gfx/ycbcr/moz.build                  |   2 +
 4 files changed, 195 insertions(+), 10 deletions(-)
 create mode 100644 gfx/ycbcr/YCbCrUtils.cpp
 create mode 100644 gfx/ycbcr/YCbCrUtils.h

diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index cc934831b3b8..7710173fe4c2 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -13,6 +13,7 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Helpers.h"
 #include "gfxUtils.h"
+#include "YCbCrUtils.h"
 #include <algorithm>
 #include "ImageContainer.h"
 #define PIXMAN_DONT_DEFINE_STDINT
@@ -175,24 +176,20 @@ public:
     PlanarYCbCrData data;
     DeserializerToPlanarYCbCrImageData(deserializer, data);
 
-    gfxImageFormat format = gfxImageFormatRGB24;
-    gfxIntSize size;
-    gfxUtils::GetYCbCrToRGBDestFormatAndSize(data, format, size);
+    gfx::SurfaceFormat format = FORMAT_B8G8R8X8;
+    gfx::IntSize size;
+    gfx::GetYCbCrToRGBDestFormatAndSize(data, format, size);
     if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
         size.height > PlanarYCbCrImage::MAX_DIMENSION) {
       NS_ERROR("Illegal image dest width or height");
       return false;
     }
 
-    mSize = ToIntSize(size);
-    mFormat = (format == gfxImageFormatRGB24)
-              ? FORMAT_B8G8R8X8
-              : FORMAT_B8G8R8A8;
+    mSize = size;
+    mFormat = format;
 
     RefPtr<DataSourceSurface> surface = Factory::CreateDataSourceSurface(mSize, mFormat);
-    gfxUtils::ConvertYCbCrToRGB(data, format, size,
-                                surface->GetData(),
-                                surface->Stride());
+    gfx::ConvertYCbCrToRGB(data, format, size, surface->GetData(), surface->Stride());
 
     mSurface = surface;
     return true;
diff --git a/gfx/ycbcr/YCbCrUtils.cpp b/gfx/ycbcr/YCbCrUtils.cpp
new file mode 100644
index 000000000000..0f662008b95a
--- /dev/null
+++ b/gfx/ycbcr/YCbCrUtils.cpp
@@ -0,0 +1,156 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gfx2DGlue.h"
+
+#include "YCbCrUtils.h"
+#include "yuv_convert.h"
+#include "ycbcr_to_rgb565.h"
+
+namespace mozilla {
+namespace gfx {
+
+void
+GetYCbCrToRGBDestFormatAndSize(const layers::PlanarYCbCrData& aData,
+                               SurfaceFormat& aSuggestedFormat,
+                               IntSize& aSuggestedSize)
+{
+  YUVType yuvtype =
+    TypeFromSize(aData.mYSize.width,
+                 aData.mYSize.height,
+                 aData.mCbCrSize.width,
+                 aData.mCbCrSize.height);
+
+  // 'prescale' is true if the scaling is to be done as part of the
+  // YCbCr to RGB conversion rather than on the RGB data when rendered.
+  bool prescale = aSuggestedSize.width > 0 && aSuggestedSize.height > 0 &&
+                  aSuggestedSize != aData.mPicSize;
+
+  if (aSuggestedFormat == FORMAT_R5G6B5) {
+#if defined(HAVE_YCBCR_TO_RGB565)
+    if (prescale &&
+        !IsScaleYCbCrToRGB565Fast(aData.mPicX,
+                                  aData.mPicY,
+                                  aData.mPicSize.width,
+                                  aData.mPicSize.height,
+                                  aSuggestedSize.width,
+                                  aSuggestedSize.height,
+                                  yuvtype,
+                                  FILTER_BILINEAR) &&
+        IsConvertYCbCrToRGB565Fast(aData.mPicX,
+                                   aData.mPicY,
+                                   aData.mPicSize.width,
+                                   aData.mPicSize.height,
+                                   yuvtype)) {
+      prescale = false;
+    }
+#else
+    // yuv2rgb16 function not available
+    aSuggestedFormat = FORMAT_B8G8R8X8;
+#endif
+  }
+  else if (aSuggestedFormat != FORMAT_B8G8R8X8) {
+    // No other formats are currently supported.
+    aSuggestedFormat = FORMAT_B8G8R8X8;
+  }
+  if (aSuggestedFormat == FORMAT_B8G8R8X8) {
+    /* ScaleYCbCrToRGB32 does not support a picture offset, nor 4:4:4 data.
+     See bugs 639415 and 640073. */
+    if (aData.mPicX != 0 || aData.mPicY != 0 || yuvtype == YV24)
+      prescale = false;
+  }
+  if (!prescale) {
+    aSuggestedSize = aData.mPicSize;
+  }
+}
+
+void
+ConvertYCbCrToRGB(const layers::PlanarYCbCrData& aData,
+                  const SurfaceFormat& aDestFormat,
+                  const IntSize& aDestSize,
+                  unsigned char* aDestBuffer,
+                  int32_t aStride)
+{
+  // ConvertYCbCrToRGB et al. assume the chroma planes are rounded up if the
+  // luma plane is odd sized.
+  MOZ_ASSERT((aData.mCbCrSize.width == aData.mYSize.width ||
+              aData.mCbCrSize.width == (aData.mYSize.width + 1) >> 1) &&
+             (aData.mCbCrSize.height == aData.mYSize.height ||
+              aData.mCbCrSize.height == (aData.mYSize.height + 1) >> 1));
+  YUVType yuvtype =
+    TypeFromSize(aData.mYSize.width,
+                 aData.mYSize.height,
+                 aData.mCbCrSize.width,
+                 aData.mCbCrSize.height);
+
+  // Convert from YCbCr to RGB now, scaling the image if needed.
+  if (aDestSize != ToIntSize(aData.mPicSize)) {
+#if defined(HAVE_YCBCR_TO_RGB565)
+    if (aDestFormat == FORMAT_R5G6B5) {
+      ScaleYCbCrToRGB565(aData.mYChannel,
+                         aData.mCbChannel,
+                         aData.mCrChannel,
+                         aDestBuffer,
+                         aData.mPicX,
+                         aData.mPicY,
+                         aData.mPicSize.width,
+                         aData.mPicSize.height,
+                         aDestSize.width,
+                         aDestSize.height,
+                         aData.mYStride,
+                         aData.mCbCrStride,
+                         aStride,
+                         yuvtype,
+                         FILTER_BILINEAR);
+    } else
+#endif
+      ScaleYCbCrToRGB32(aData.mYChannel, //
+                        aData.mCbChannel,
+                        aData.mCrChannel,
+                        aDestBuffer,
+                        aData.mPicSize.width,
+                        aData.mPicSize.height,
+                        aDestSize.width,
+                        aDestSize.height,
+                        aData.mYStride,
+                        aData.mCbCrStride,
+                        aStride,
+                        yuvtype,
+                        ROTATE_0,
+                        FILTER_BILINEAR);
+  } else { // no prescale
+#if defined(HAVE_YCBCR_TO_RGB565)
+    if (aDestFormat == FORMAT_R5G6B5) {
+      ConvertYCbCrToRGB565(aData.mYChannel,
+                           aData.mCbChannel,
+                           aData.mCrChannel,
+                           aDestBuffer,
+                           aData.mPicX,
+                           aData.mPicY,
+                           aData.mPicSize.width,
+                           aData.mPicSize.height,
+                           aData.mYStride,
+                           aData.mCbCrStride,
+                           aStride,
+                           yuvtype);
+    } else // aDestFormat != gfxImageFormatRGB16_565
+#endif
+      ConvertYCbCrToRGB32(aData.mYChannel, //
+                          aData.mCbChannel,
+                          aData.mCrChannel,
+                          aDestBuffer,
+                          aData.mPicX,
+                          aData.mPicY,
+                          aData.mPicSize.width,
+                          aData.mPicSize.height,
+                          aData.mYStride,
+                          aData.mCbCrStride,
+                          aStride,
+                          yuvtype);
+  }
+}
+
+}
+}
diff --git a/gfx/ycbcr/YCbCrUtils.h b/gfx/ycbcr/YCbCrUtils.h
new file mode 100644
index 000000000000..1e83f4426ff2
--- /dev/null
+++ b/gfx/ycbcr/YCbCrUtils.h
@@ -0,0 +1,30 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_UTILS_H_
+#define MOZILLA_GFX_UTILS_H_
+
+#include "mozilla/gfx/Types.h"
+#include "ImageContainer.h"
+
+namespace mozilla {
+namespace gfx {
+
+void
+GetYCbCrToRGBDestFormatAndSize(const layers::PlanarYCbCrData& aData,
+                               SurfaceFormat& aSuggestedFormat,
+                               IntSize& aSuggestedSize);
+
+void
+ConvertYCbCrToRGB(const layers::PlanarYCbCrData& aData,
+                  const SurfaceFormat& aDestFormat,
+                  const IntSize& aDestSize,
+                  unsigned char* aDestBuffer,
+                  int32_t aStride);
+
+}
+}
+
+#endif /* MOZILLA_GFX_UTILS_H_ */
diff --git a/gfx/ycbcr/moz.build b/gfx/ycbcr/moz.build
index 5399782283a8..6de1bc5ee3e2 100644
--- a/gfx/ycbcr/moz.build
+++ b/gfx/ycbcr/moz.build
@@ -7,12 +7,14 @@
 EXPORTS += [
     'chromium_types.h',
     'ycbcr_to_rgb565.h',
+    'YCbCrUtils.h',
     'yuv_convert.h',
     'yuv_row.h',
 ]
 
 UNIFIED_SOURCES += [
     'ycbcr_to_rgb565.cpp',
+    'YCbCrUtils.cpp',
     'yuv_convert.cpp',
     'yuv_row_c.cpp',
     'yuv_row_table.cpp',

From 3d5f99f7f3a4a719a7e1b38a707013059a3856a0 Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:32:02 +0100
Subject: [PATCH 126/144] Bug 929513 - Replace some instances of gfxIntSize
 with gfx::IntSize r=nical

---
 content/media/VideoFrameContainer.cpp         |  4 +--
 content/media/encoder/TrackEncoder.cpp        |  2 +-
 .../webrtc/MediaEngineTabVideoSource.cpp      |  5 ++--
 gfx/layers/D3D9SurfaceImage.cpp               |  7 +++---
 gfx/layers/D3D9SurfaceImage.h                 |  4 +--
 gfx/layers/GrallocImages.cpp                  |  6 ++---
 gfx/layers/ImageContainer.cpp                 | 22 ++++++++--------
 gfx/layers/ImageContainer.h                   | 23 +++++++++--------
 gfx/layers/ImageLayers.cpp                    |  3 ++-
 gfx/layers/MacIOSurfaceImage.h                |  3 ++-
 gfx/layers/SharedTextureImage.h               |  6 ++---
 gfx/layers/basic/BasicImageLayer.cpp          |  8 +++---
 gfx/layers/basic/BasicImages.cpp              | 25 +++++++++++--------
 gfx/layers/client/ImageClient.cpp             |  1 -
 gfx/layers/client/TextureClient.cpp           |  4 +--
 gfx/layers/composite/ImageLayerComposite.cpp  |  1 -
 gfx/layers/d3d10/ImageLayerD3D10.cpp          | 15 +++++++----
 gfx/layers/d3d10/ImageLayerD3D10.h            |  6 +++--
 gfx/layers/d3d9/ImageLayerD3D9.cpp            |  4 +--
 gfx/layers/ipc/LayersSurfaces.ipdlh           |  2 +-
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp     |  1 -
 gfx/layers/ipc/SharedRGBImage.cpp             |  4 +--
 gfx/layers/ipc/SharedRGBImage.h               |  7 +++---
 gfx/layers/opengl/OGLShaderProgram.cpp        |  1 -
 gfx/layers/opengl/TextureHostOGL.cpp          |  5 ++--
 layout/base/nsDisplayList.cpp                 |  4 +--
 layout/base/nsLayoutUtils.cpp                 |  5 ++--
 layout/generic/nsVideoFrame.cpp               |  2 +-
 .../src/mediapipeline/MediaPipeline.cpp       |  5 ++--
 29 files changed, 97 insertions(+), 88 deletions(-)

diff --git a/content/media/VideoFrameContainer.cpp b/content/media/VideoFrameContainer.cpp
index 66ff347b006f..b6e8b0cc4268 100644
--- a/content/media/VideoFrameContainer.cpp
+++ b/content/media/VideoFrameContainer.cpp
@@ -40,7 +40,7 @@ void VideoFrameContainer::SetCurrentFrame(const gfxIntSize& aIntrinsicSize,
     mIntrinsicSizeChanged = true;
   }
 
-  gfxIntSize oldFrameSize = mImageContainer->GetCurrentSize();
+  gfx::IntSize oldFrameSize = mImageContainer->GetCurrentSize();
   TimeStamp lastPaintTime = mImageContainer->GetPaintTime();
   if (!lastPaintTime.IsNull() && !mPaintTarget.IsNull()) {
     mPaintDelay = lastPaintTime - mPaintTarget;
@@ -57,7 +57,7 @@ void VideoFrameContainer::SetCurrentFrame(const gfxIntSize& aIntrinsicSize,
   mImageContainer->UnlockCurrentImage();
 
   mImageContainer->SetCurrentImage(aImage);
-  gfxIntSize newFrameSize = mImageContainer->GetCurrentSize();
+  gfx::IntSize newFrameSize = mImageContainer->GetCurrentSize();
   if (oldFrameSize != newFrameSize) {
     mImageSizeChanged = true;
   }
diff --git a/content/media/encoder/TrackEncoder.cpp b/content/media/encoder/TrackEncoder.cpp
index a7c1b908be89..fdecba8eeb8c 100644
--- a/content/media/encoder/TrackEncoder.cpp
+++ b/content/media/encoder/TrackEncoder.cpp
@@ -147,7 +147,7 @@ VideoTrackEncoder::NotifyQueuedTrackChanges(MediaStreamGraph* aGraph,
     while (!iter.IsEnded()) {
       VideoChunk chunk = *iter;
       if (!chunk.IsNull()) {
-        gfxIntSize imgsize = chunk.mFrame.GetImage()->GetSize();
+        gfx::IntSize imgsize = chunk.mFrame.GetImage()->GetSize();
         nsresult rv = Init(imgsize.width, imgsize.height, aTrackRate);
         if (NS_FAILED(rv)) {
           LOG("[VideoTrackEncoder]: Fail to initialize the encoder!");
diff --git a/content/media/webrtc/MediaEngineTabVideoSource.cpp b/content/media/webrtc/MediaEngineTabVideoSource.cpp
index a73cf2c9ed90..e29216d41251 100644
--- a/content/media/webrtc/MediaEngineTabVideoSource.cpp
+++ b/content/media/webrtc/MediaEngineTabVideoSource.cpp
@@ -6,6 +6,7 @@
 #include "nsPresContext.h"
 #include "gfxImageSurface.h"
 #include "gfxContext.h"
+#include "gfx2DGlue.h"
 #include "ImageContainer.h"
 #include "Layers.h"
 #include "nsIInterfaceRequestorUtils.h"
@@ -154,8 +155,8 @@ NotifyPull(MediaStreamGraph*, SourceMediaStream* aSource, mozilla::TrackID aID,
   if (delta > 0) {
     // nullptr images are allowed
     if (image) {
-      gfxIntSize size = image->GetSize();
-      segment.AppendFrame(image.forget(), delta, size);
+      gfx::IntSize size = image->GetSize();
+      segment.AppendFrame(image.forget(), delta, gfx::ThebesIntSize(size));
     } else {
       segment.AppendFrame(nullptr, delta, gfxIntSize(0,0));
     }
diff --git a/gfx/layers/D3D9SurfaceImage.cpp b/gfx/layers/D3D9SurfaceImage.cpp
index 7d75bc5a3ad6..dd3ec8ddd8ef 100644
--- a/gfx/layers/D3D9SurfaceImage.cpp
+++ b/gfx/layers/D3D9SurfaceImage.cpp
@@ -5,6 +5,7 @@
 
 #include "D3D9SurfaceImage.h"
 #include "gfxImageSurface.h"
+#include "gfx2DGlue.h"
 
 namespace mozilla {
 namespace layers {
@@ -73,7 +74,7 @@ D3D9SurfaceImage::SetData(const Data& aData)
 
   mTexture = texture;
   mShareHandle = shareHandle;
-  mSize = gfxIntSize(region.width, region.height);
+  mSize = gfx::IntSize(region.width, region.height);
   mQuery = query;
 
   return S_OK;
@@ -109,7 +110,7 @@ D3D9SurfaceImage::GetDesc() const
   return mDesc;
 }
 
-gfxIntSize
+gfx::IntSize
 D3D9SurfaceImage::GetSize()
 {
   return mSize;
@@ -122,7 +123,7 @@ D3D9SurfaceImage::GetAsSurface()
 
   HRESULT hr;
   nsRefPtr<gfxImageSurface> surface =
-    new gfxImageSurface(mSize, gfxImageFormatRGB24);
+    new gfxImageSurface(gfx::ThebesIntSize(mSize), gfxImageFormatRGB24);
 
   if (!surface->CairoSurface() || surface->CairoStatus()) {
     NS_WARNING("Failed to created Cairo image surface for D3D9SurfaceImage.");
diff --git a/gfx/layers/D3D9SurfaceImage.h b/gfx/layers/D3D9SurfaceImage.h
index e71397835ba2..17506db228dd 100644
--- a/gfx/layers/D3D9SurfaceImage.h
+++ b/gfx/layers/D3D9SurfaceImage.h
@@ -44,7 +44,7 @@ public:
   // complete.
   HANDLE GetShareHandle();
 
-  gfxIntSize GetSize() MOZ_OVERRIDE;
+  gfx::IntSize GetSize() MOZ_OVERRIDE;
 
   already_AddRefed<gfxASurface> GetAsSurface() MOZ_OVERRIDE;
 
@@ -54,7 +54,7 @@ private:
   // is complete, whereupon the texture is safe to use.
   void EnsureSynchronized();
 
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
   RefPtr<IDirect3DTexture9> mTexture;
   RefPtr<IDirect3DQuery9> mQuery;
   HANDLE mShareHandle;
diff --git a/gfx/layers/GrallocImages.cpp b/gfx/layers/GrallocImages.cpp
index 856d80ba79be..3b06733ca2a2 100644
--- a/gfx/layers/GrallocImages.cpp
+++ b/gfx/layers/GrallocImages.cpp
@@ -230,7 +230,7 @@ GrallocImage::GetAsSurface()
   }
 
   nsRefPtr<gfxImageSurface> imageSurface =
-    new gfxImageSurface(GetSize(), gfxImageFormatRGB16_565);
+    new gfxImageSurface(gfx::ThebesIntSize(GetSize()), gfxImageFormatRGB16_565);
 
   uint32_t width = GetSize().width;
   uint32_t height = GetSize().height;
@@ -295,9 +295,7 @@ GrallocImage::GetTextureClient()
       flags |= TEXTURE_RB_SWAPPED;
     }
     GrallocBufferActor* actor = static_cast<GrallocBufferActor*>(desc.bufferChild());
-    mTextureClient = new GrallocTextureClientOGL(actor,
-                                                 gfx::ToIntSize(mSize),
-                                                 flags);
+    mTextureClient = new GrallocTextureClientOGL(actor, mSize, flags);
     mTextureClient->SetGraphicBufferLocked(mGraphicBuffer);
   }
   return mTextureClient;
diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index e977f69143be..babe7e6318d6 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -7,6 +7,7 @@
 #include "ImageContainer.h"
 #include <string.h>                     // for memcpy, memset
 #include "SharedTextureImage.h"         // for SharedTextureImage
+#include "gfx2DGlue.h"
 #include "gfxImageSurface.h"            // for gfxImageSurface
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxUtils.h"                   // for gfxUtils
@@ -16,6 +17,7 @@
 #include "mozilla/layers/ImageBridgeChild.h"  // for ImageBridgeChild
 #include "mozilla/layers/ImageClient.h"  // for ImageClient
 #include "nsISupportsUtils.h"           // for NS_IF_ADDREF
+#include "YCbCrUtils.h"                 // for YCbCr conversions
 #ifdef MOZ_WIDGET_GONK
 #include "GrallocImages.h"
 #endif
@@ -50,7 +52,7 @@ Atomic<int32_t> Image::sSerialCounter(0);
 already_AddRefed<Image>
 ImageFactory::CreateImage(const ImageFormat *aFormats,
                           uint32_t aNumFormats,
-                          const gfxIntSize &,
+                          const gfx::IntSize &,
                           BufferRecycleBin *aRecycleBin)
 {
   if (!aNumFormats) {
@@ -287,7 +289,7 @@ ImageContainer::LockCurrentImage()
 }
 
 already_AddRefed<gfxASurface>
-ImageContainer::LockCurrentAsSurface(gfxIntSize *aSize, Image** aCurrentImage)
+ImageContainer::LockCurrentAsSurface(gfx::IntSize *aSize, Image** aCurrentImage)
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
 
@@ -345,7 +347,7 @@ ImageContainer::UnlockCurrentImage()
 }
 
 already_AddRefed<gfxASurface>
-ImageContainer::GetCurrentAsSurface(gfxIntSize *aSize)
+ImageContainer::GetCurrentAsSurface(gfx::IntSize *aSize)
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
 
@@ -364,7 +366,7 @@ ImageContainer::GetCurrentAsSurface(gfxIntSize *aSize)
   return mActiveImage->GetAsSurface();
 }
 
-gfxIntSize
+gfx::IntSize
 ImageContainer::GetCurrentSize()
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
@@ -556,9 +558,9 @@ PlanarYCbCrImage::GetAsSurface()
     return result.forget();
   }
 
-  gfxImageFormat format = GetOffscreenFormat();
-  gfxIntSize size(mSize);
-  gfxUtils::GetYCbCrToRGBDestFormatAndSize(mData, format, size);
+  gfx::SurfaceFormat format = gfx::ImageFormatToSurfaceFormat(GetOffscreenFormat());
+  gfx::IntSize size(mSize);
+  gfx::GetYCbCrToRGBDestFormatAndSize(mData, format, size);
   if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
       size.height > PlanarYCbCrImage::MAX_DIMENSION) {
     NS_ERROR("Illegal image dest width or height");
@@ -566,11 +568,9 @@ PlanarYCbCrImage::GetAsSurface()
   }
 
   nsRefPtr<gfxImageSurface> imageSurface =
-    new gfxImageSurface(mSize, format);
+    new gfxImageSurface(gfx::ThebesIntSize(mSize), gfx::SurfaceFormatToImageFormat(format));
 
-  gfxUtils::ConvertYCbCrToRGB(mData, format, mSize,
-                              imageSurface->Data(),
-                              imageSurface->Stride());
+  gfx::ConvertYCbCrToRGB(mData, format, mSize, imageSurface->Data(), imageSurface->Stride());
 
   mSurface = imageSurface;
 
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index 933ce00a68da..0ebfbe95faaa 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -15,6 +15,7 @@
 #include "mozilla/Mutex.h"              // for Mutex
 #include "mozilla/ReentrantMonitor.h"   // for ReentrantMonitorAutoEnter, etc
 #include "mozilla/TimeStamp.h"          // for TimeStamp
+#include "mozilla/gfx/Point.h"          // For IntSize
 #include "mozilla/layers/LayersTypes.h"  // for LayersBackend, etc
 #include "mozilla/mozalloc.h"           // for operator delete, etc
 #include "nsAutoPtr.h"                  // for nsRefPtr, nsAutoArrayPtr, etc
@@ -147,7 +148,7 @@ public:
   void* GetImplData() { return mImplData; }
 
   virtual already_AddRefed<gfxASurface> GetAsSurface() = 0;
-  virtual gfxIntSize GetSize() = 0;
+  virtual gfx::IntSize GetSize() = 0;
   virtual nsIntRect GetPictureRect()
   {
     return nsIntRect(0, 0, GetSize().width, GetSize().height);
@@ -262,7 +263,7 @@ protected:
 
   virtual already_AddRefed<Image> CreateImage(const ImageFormat* aFormats,
                                               uint32_t aNumFormats,
-                                              const gfxIntSize &aScaleHint,
+                                              const gfx::IntSize &aScaleHint,
                                               BufferRecycleBin *aRecycleBin);
 
 };
@@ -483,7 +484,7 @@ public:
    * the lock methods should be used to avoid the copy, however this should be
    * avoided if the surface is required for a long period of time.
    */
-  already_AddRefed<gfxASurface> GetCurrentAsSurface(gfxIntSize* aSizeResult);
+  already_AddRefed<gfxASurface> GetCurrentAsSurface(gfx::IntSize* aSizeResult);
 
   /**
    * This is similar to GetCurrentAsSurface, however this does not make a copy
@@ -493,7 +494,7 @@ public:
    * type of image. Optionally a pointer can be passed to receive the current
    * image.
    */
-  already_AddRefed<gfxASurface> LockCurrentAsSurface(gfxIntSize* aSizeResult,
+  already_AddRefed<gfxASurface> LockCurrentAsSurface(gfx::IntSize* aSizeResult,
                                                      Image** aCurrentImage = nullptr);
 
   /**
@@ -501,7 +502,7 @@ public:
    * Can be called on any thread. This method takes mReentrantMonitor when accessing
    * thread-shared state.
    */
-  gfxIntSize GetCurrentSize();
+  gfx::IntSize GetCurrentSize();
 
   /**
    * Sets a size that the image is expected to be rendered at.
@@ -673,7 +674,7 @@ public:
   ~AutoLockImage() { if (mContainer) { mContainer->UnlockCurrentImage(); } }
 
   Image* GetImage() { return mImage; }
-  const gfxIntSize &GetSize() { return mSize; }
+  const gfx::IntSize &GetSize() { return mSize; }
 
   void Unlock() { 
     if (mContainer) {
@@ -698,7 +699,7 @@ public:
 private:
   ImageContainer *mContainer;
   nsRefPtr<Image> mImage;
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
 };
 
 struct PlanarYCbCrData {
@@ -819,7 +820,7 @@ public:
 
   virtual bool IsValid() { return !!mBufferSize; }
 
-  virtual gfxIntSize GetSize() { return mSize; }
+  virtual gfx::IntSize GetSize() { return mSize; }
 
   PlanarYCbCrImage(BufferRecycleBin *aRecycleBin);
 
@@ -849,7 +850,7 @@ protected:
   nsAutoArrayPtr<uint8_t> mBuffer;
   uint32_t mBufferSize;
   Data mData;
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
   gfxImageFormat mOffscreenFormat;
   nsCountedRef<nsMainThreadSurfaceRef> mSurface;
   nsRefPtr<BufferRecycleBin> mRecycleBin;
@@ -885,7 +886,7 @@ public:
     return surface.forget();
   }
 
-  gfxIntSize GetSize() { return mSize; }
+  gfx::IntSize GetSize() { return mSize; }
 
   CairoImage() : Image(nullptr, CAIRO_SURFACE) {}
 
@@ -899,7 +900,7 @@ public:
 
   already_AddRefed<gfxASurface> GetAsSurface();
 
-  gfxIntSize GetSize() { return mSize; }
+  gfx::IntSize GetSize() { return mSize; }
 
   unsigned char *mData;
   int mStride;
diff --git a/gfx/layers/ImageLayers.cpp b/gfx/layers/ImageLayers.cpp
index 62d0631febe2..3d3c87f66f60 100644
--- a/gfx/layers/ImageLayers.cpp
+++ b/gfx/layers/ImageLayers.cpp
@@ -9,6 +9,7 @@
 #include "gfxRect.h"                    // for gfxRect
 #include "nsDebug.h"                    // for NS_ASSERTION
 #include "nsISupportsImpl.h"            // for ImageContainer::Release, etc
+#include "gfx2DGlue.h"
 
 namespace mozilla {
 namespace layers {
@@ -33,7 +34,7 @@ void ImageLayer::ComputeEffectiveTransforms(const gfx3DMatrix& aTransformToSurfa
   // Snap image edges to pixel boundaries
   gfxRect sourceRect(0, 0, 0, 0);
   if (mContainer) {
-    sourceRect.SizeTo(mContainer->GetCurrentSize());
+    sourceRect.SizeTo(gfx::ThebesIntSize(mContainer->GetCurrentSize()));
     if (mScaleMode != SCALE_NONE &&
         sourceRect.width != 0.0 && sourceRect.height != 0.0) {
       NS_ASSERTION(mScaleMode == SCALE_STRETCH,
diff --git a/gfx/layers/MacIOSurfaceImage.h b/gfx/layers/MacIOSurfaceImage.h
index 66ba6b18df9f..8999af922582 100644
--- a/gfx/layers/MacIOSurfaceImage.h
+++ b/gfx/layers/MacIOSurfaceImage.h
@@ -8,6 +8,7 @@
 
 #include "ImageContainer.h"
 #include "mozilla/gfx/MacIOSurface.h"
+#include "mozilla/gfx/Point.h"
 #include "mozilla/layers/TextureClient.h"
 #include "gfxImageSurface.h"
 
@@ -21,7 +22,7 @@ public:
   void SetSurface(MacIOSurface* aSurface) { mSurface = aSurface; }
   MacIOSurface* GetSurface() { return mSurface; }
 
-  gfxIntSize GetSize() {
+  gfx::IntSize GetSize() {
     return gfxIntSize(mSurface->GetDevicePixelWidth(), mSurface->GetDevicePixelHeight());
   }
 
diff --git a/gfx/layers/SharedTextureImage.h b/gfx/layers/SharedTextureImage.h
index 575c2f370683..2d5b5cb80aed 100644
--- a/gfx/layers/SharedTextureImage.h
+++ b/gfx/layers/SharedTextureImage.h
@@ -11,7 +11,7 @@
 #include "ImageTypes.h"                 // for ImageFormat::SHARED_TEXTURE
 #include "gfxPoint.h"                   // for gfxIntSize
 #include "nsCOMPtr.h"                   // for already_AddRefed
-#include "nsSize.h"                     // for nsIntSize
+#include "mozilla/gfx/Point.h"          // for IntSize
 
 class gfxASurface;
 
@@ -27,14 +27,14 @@ public:
   struct Data {
     gl::SharedTextureHandle mHandle;
     gl::SharedTextureShareType mShareType;
-    gfxIntSize mSize;
+    gfx::IntSize mSize;
     bool mInverted;
   };
 
   void SetData(const Data& aData) { mData = aData; }
   const Data* GetData() { return &mData; }
 
-  gfxIntSize GetSize() { return mData.mSize; }
+  gfx::IntSize GetSize() { return mData.mSize; }
 
   virtual already_AddRefed<gfxASurface> GetAsSurface() {
     return nullptr;
diff --git a/gfx/layers/basic/BasicImageLayer.cpp b/gfx/layers/basic/BasicImageLayer.cpp
index a41ba984b2a7..002c7043be54 100644
--- a/gfx/layers/basic/BasicImageLayer.cpp
+++ b/gfx/layers/basic/BasicImageLayer.cpp
@@ -12,7 +12,6 @@
 #include "gfxASurface.h"                // for gfxASurface, etc
 #include "gfxContext.h"                 // for gfxContext
 #include "gfxPattern.h"                 // for gfxPattern, etc
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "gfxUtils.h"                   // for gfxUtils
 #ifdef MOZ_X11
 #include "gfxXlibSurface.h"             // for gfxXlibSurface
@@ -25,6 +24,7 @@
 #include "nsRect.h"                     // for nsIntRect
 #include "nsRegion.h"                   // for nsIntRegion
 #include "nsTraceRefcnt.h"              // for MOZ_COUNT_CTOR, etc
+#include "mozilla/gfx/Point.h"          // for IntSize
 
 using namespace mozilla::gfx;
 
@@ -69,7 +69,7 @@ protected:
                           float aOpacity,
                           Layer* aMaskLayer);
 
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
 };
 
 void
@@ -94,7 +94,7 @@ BasicImageLayer::GetAndPaintCurrentImage(gfxContext* aContext,
   nsRefPtr<gfxASurface> surface;
   AutoLockImage autoLock(mContainer, getter_AddRefs(surface));
   Image *image = autoLock.GetImage();
-  gfxIntSize size = mSize = autoLock.GetSize();
+  gfx::IntSize size = mSize = autoLock.GetSize();
 
   if (!surface || surface->CairoStatus()) {
     return nullptr;
@@ -166,7 +166,7 @@ BasicImageLayer::GetAsSurface(gfxASurface** aSurface,
     return false;
   }
 
-  gfxIntSize dontCare;
+  gfx::IntSize dontCare;
   nsRefPtr<gfxASurface> surface = mContainer->GetCurrentAsSurface(&dontCare);
   *aSurface = surface.forget().get();
   return true;
diff --git a/gfx/layers/basic/BasicImages.cpp b/gfx/layers/basic/BasicImages.cpp
index ee33c089fb48..5415b0c7ffe2 100644
--- a/gfx/layers/basic/BasicImages.cpp
+++ b/gfx/layers/basic/BasicImages.cpp
@@ -11,7 +11,6 @@
 #include "gfxASurface.h"                // for gfxASurface, etc
 #include "gfxImageSurface.h"            // for gfxImageSurface
 #include "gfxPlatform.h"                // for gfxPlatform, gfxImageFormat
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "gfxUtils.h"                   // for gfxUtils
 #include "mozilla/mozalloc.h"           // for operator delete[], etc
 #include "nsAutoPtr.h"                  // for nsRefPtr, nsAutoArrayPtr
@@ -20,6 +19,9 @@
 #include "nsDebug.h"                    // for NS_ERROR, NS_ASSERTION
 #include "nsISupportsImpl.h"            // for Image::Release, etc
 #include "nsThreadUtils.h"              // for NS_IsMainThread
+#include "mozilla/gfx/Point.h"          // for IntSize
+#include "gfx2DGlue.h"
+#include "YCbCrUtils.h"                 // for YCbCr conversions
 #ifdef XP_MACOSX
 #include "gfxQuartzImageSurface.h"
 #endif
@@ -30,7 +32,7 @@ namespace layers {
 class BasicPlanarYCbCrImage : public PlanarYCbCrImage
 {
 public:
-  BasicPlanarYCbCrImage(const gfxIntSize& aScaleHint, gfxImageFormat aOffscreenFormat, BufferRecycleBin *aRecycleBin)
+  BasicPlanarYCbCrImage(const gfx::IntSize& aScaleHint, gfxImageFormat aOffscreenFormat, BufferRecycleBin *aRecycleBin)
     : PlanarYCbCrImage(aRecycleBin)
     , mScaleHint(aScaleHint)
     , mDelayedConversion(false)
@@ -54,7 +56,7 @@ public:
 
 private:
   nsAutoArrayPtr<uint8_t> mDecodedBuffer;
-  gfxIntSize mScaleHint;
+  gfx::IntSize mScaleHint;
   int mStride;
   bool mDelayedConversion;
 };
@@ -66,7 +68,7 @@ public:
 
   virtual already_AddRefed<Image> CreateImage(const ImageFormat* aFormats,
                                               uint32_t aNumFormats,
-                                              const gfxIntSize &aScaleHint,
+                                              const gfx::IntSize &aScaleHint,
                                               BufferRecycleBin *aRecycleBin)
   {
     if (!aNumFormats) {
@@ -99,25 +101,26 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
     return;
   }
 
-  gfxImageFormat format = GetOffscreenFormat();
+  gfx::SurfaceFormat format = gfx::ImageFormatToSurfaceFormat(GetOffscreenFormat());
 
-  gfxIntSize size(mScaleHint);
-  gfxUtils::GetYCbCrToRGBDestFormatAndSize(aData, format, size);
+  gfx::IntSize size(mScaleHint);
+  gfx::GetYCbCrToRGBDestFormatAndSize(aData, format, size);
   if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
       size.height > PlanarYCbCrImage::MAX_DIMENSION) {
     NS_ERROR("Illegal image dest width or height");
     return;
   }
 
-  mStride = gfxASurface::FormatStrideForWidth(format, size.width);
+  gfxImageFormat iFormat = gfx::SurfaceFormatToImageFormat(format);
+  mStride = gfxASurface::FormatStrideForWidth(iFormat, size.width);
   mDecodedBuffer = AllocateBuffer(size.height * mStride);
   if (!mDecodedBuffer) {
     // out of memory
     return;
   }
 
-  gfxUtils::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer, mStride);
-  SetOffscreenFormat(format);
+  gfx::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer, mStride);
+  SetOffscreenFormat(iFormat);
   mSize = size;
 }
 
@@ -146,7 +149,7 @@ BasicPlanarYCbCrImage::GetAsSurface()
   gfxImageFormat format = GetOffscreenFormat();
 
   nsRefPtr<gfxImageSurface> imgSurface =
-      new gfxImageSurface(mDecodedBuffer, mSize, mStride, format);
+    new gfxImageSurface(mDecodedBuffer, gfx::ThebesIntSize(mSize), mStride, format);
   if (!imgSurface || imgSurface->CairoStatus() != 0) {
     return nullptr;
   }
diff --git a/gfx/layers/client/ImageClient.cpp b/gfx/layers/client/ImageClient.cpp
index 90476e3d5e38..51b95753db6e 100644
--- a/gfx/layers/client/ImageClient.cpp
+++ b/gfx/layers/client/ImageClient.cpp
@@ -11,7 +11,6 @@
 #include "gfx2DGlue.h"                  // for ImageFormatToSurfaceFormat
 #include "gfxASurface.h"                // for gfxASurface, etc
 #include "gfxPlatform.h"                // for gfxPlatform
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/RefPtr.h"             // for RefPtr, TemporaryRef
 #include "mozilla/gfx/BaseSize.h"       // for BaseSize
diff --git a/gfx/layers/client/TextureClient.cpp b/gfx/layers/client/TextureClient.cpp
index a84b8981ce70..33e74745c0e6 100644
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -812,7 +812,7 @@ bool AutoLockShmemClient::Update(Image* aImage,
     return false;
   }
 
-  gfxIntSize size = aImage->GetSize();
+  gfx::IntSize size = aImage->GetSize();
 
   gfxContentType contentType = aSurface->GetContentType();
   bool isOpaque = (aContentFlags & Layer::CONTENT_OPAQUE);
@@ -820,7 +820,7 @@ bool AutoLockShmemClient::Update(Image* aImage,
       isOpaque) {
     contentType = GFX_CONTENT_COLOR;
   }
-  mDeprecatedTextureClient->EnsureAllocated(gfx::IntSize(size.width, size.height), contentType);
+  mDeprecatedTextureClient->EnsureAllocated(size, contentType);
 
   OpenMode mode = mDeprecatedTextureClient->GetAccessMode() == DeprecatedTextureClient::ACCESS_READ_WRITE
                   ? OPEN_READ_WRITE
diff --git a/gfx/layers/composite/ImageLayerComposite.cpp b/gfx/layers/composite/ImageLayerComposite.cpp
index ee78d2722371..aa2ec30c3e37 100644
--- a/gfx/layers/composite/ImageLayerComposite.cpp
+++ b/gfx/layers/composite/ImageLayerComposite.cpp
@@ -8,7 +8,6 @@
 #include "Layers.h"                     // for WriteSnapshotToDumpFile, etc
 #include "gfx2DGlue.h"                  // for ToFilter, ToMatrix4x4
 #include "gfx3DMatrix.h"                // for gfx3DMatrix
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "gfxRect.h"                    // for gfxRect
 #include "gfxUtils.h"                   // for gfxUtils, etc
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
diff --git a/gfx/layers/d3d10/ImageLayerD3D10.cpp b/gfx/layers/d3d10/ImageLayerD3D10.cpp
index cb4ac5163b21..a5a125c9eecb 100644
--- a/gfx/layers/d3d10/ImageLayerD3D10.cpp
+++ b/gfx/layers/d3d10/ImageLayerD3D10.cpp
@@ -10,9 +10,13 @@
 #include "yuv_convert.h"
 #include "../d3d9/Nv3DVUtils.h"
 #include "D3D9SurfaceImage.h"
+#include "mozilla/gfx/Point.h"
+#include "gfx2DGlue.h"
 
 #include "gfxWindowsPlatform.h"
 
+using namespace mozilla::gfx;
+
 namespace mozilla {
 namespace layers {
 
@@ -202,7 +206,7 @@ ImageLayerD3D10::RenderLayer()
     return;
   }
 
-  gfxIntSize size = image->GetSize();
+  IntSize size = image->GetSize();
 
   SetEffectTransformAndOpacity();
 
@@ -410,7 +414,7 @@ ImageLayerD3D10::GetAsTexture(gfxIntSize* aSize)
     return nullptr;
   }
 
-  *aSize = image->GetSize();
+  *aSize = gfx::ThebesIntSize(image->GetSize());
   bool dontCare;
   nsRefPtr<ID3D10ShaderResourceView> result = GetImageSRView(image, dontCare);
   return result.forget();
@@ -465,9 +469,10 @@ RemoteDXGITextureImage::GetAsSurface()
   keyedMutex->ReleaseSync(0);
 
   nsRefPtr<gfxImageSurface> surface =
-    new gfxImageSurface(mSize, mFormat == RemoteImageData::BGRX32 ?
-                                          gfxImageFormatRGB24 :
-                                          gfxImageFormatARGB32);
+    new gfxImageSurface(ThebesIntSize(mSize),
+      mFormat == RemoteImageData::BGRX32 ?
+                 gfxImageFormatRGB24 :
+                 gfxImageFormatARGB32);
 
   if (!surface->CairoSurface() || surface->CairoStatus()) {
     NS_WARNING("Failed to created image surface for DXGI texture.");
diff --git a/gfx/layers/d3d10/ImageLayerD3D10.h b/gfx/layers/d3d10/ImageLayerD3D10.h
index 747ace698025..39944d73f484 100644
--- a/gfx/layers/d3d10/ImageLayerD3D10.h
+++ b/gfx/layers/d3d10/ImageLayerD3D10.h
@@ -11,6 +11,8 @@
 #include "ImageContainer.h"
 #include "yuv_convert.h"
 
+using namespace mozilla::gfx;
+
 namespace mozilla {
 namespace layers {
 
@@ -60,11 +62,11 @@ public:
 
   already_AddRefed<gfxASurface> GetAsSurface();
 
-  gfxIntSize GetSize() { return mSize; }
+  IntSize GetSize() { return mSize; }
 
   TextureD3D10BackendData *GetD3D10TextureBackendData(ID3D10Device *aDevice);
 
-  gfxIntSize mSize;
+  IntSize mSize;
   RemoteImageData::Format mFormat;
   HANDLE mHandle;
 };
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index 4f56e02800f0..43a1527fc520 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -403,7 +403,7 @@ ImageLayerD3D9::RenderLayer()
 
   SetShaderTransformAndOpacity();
 
-  gfxIntSize size = image->GetSize();
+  gfx::IntSize size = image->GetSize();
 
   if (image->GetFormat() == CAIRO_SURFACE ||
       image->GetFormat() == REMOTE_IMAGE_BITMAP ||
@@ -564,7 +564,7 @@ ImageLayerD3D9::GetAsTexture(gfxIntSize* aSize)
   }
 
   bool dontCare;
-  *aSize = image->GetSize();
+  *aSize = gfx::ThebesIntSize(image->GetSize());
   nsRefPtr<IDirect3DTexture9> result = GetTexture(image, dontCare);
   return result.forget();
 }
diff --git a/gfx/layers/ipc/LayersSurfaces.ipdlh b/gfx/layers/ipc/LayersSurfaces.ipdlh
index d8cfed1410aa..e9305e2cd7fd 100644
--- a/gfx/layers/ipc/LayersSurfaces.ipdlh
+++ b/gfx/layers/ipc/LayersSurfaces.ipdlh
@@ -52,7 +52,7 @@ struct SurfaceDescriptorMacIOSurface {
 struct SharedTextureDescriptor {
   SharedTextureShareType shareType;
   SharedTextureHandle handle;
-  nsIntSize size;
+  IntSize size;
   bool inverted;
 };
 
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index 3f7e969a1cf6..f90226221072 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -7,7 +7,6 @@
 #include <stddef.h>                     // for size_t
 #include <stdio.h>                      // for printf
 #include "ISurfaceAllocator.h"          // for ISurfaceAllocator, etc
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/gfx/Types.h"          // for SurfaceFormat::FORMAT_YUV
 #include "mozilla/ipc/SharedMemory.h"   // for SharedMemory, etc
diff --git a/gfx/layers/ipc/SharedRGBImage.cpp b/gfx/layers/ipc/SharedRGBImage.cpp
index 6a3c60885b34..849cbdf72ce5 100644
--- a/gfx/layers/ipc/SharedRGBImage.cpp
+++ b/gfx/layers/ipc/SharedRGBImage.cpp
@@ -104,7 +104,7 @@ DeprecatedSharedRGBImage::GetBufferSize()
   return mSize.width * mSize.height * gfxASurface::BytesPerPixel(mImageFormat);
 }
 
-gfxIntSize
+gfx::IntSize
 DeprecatedSharedRGBImage::GetSize()
 {
   return mSize;
@@ -215,7 +215,7 @@ SharedRGBImage::GetBuffer()
   return serializer.GetData();
 }
 
-gfxIntSize
+gfx::IntSize
 SharedRGBImage::GetSize()
 {
   return ThebesIntSize(mSize);
diff --git a/gfx/layers/ipc/SharedRGBImage.h b/gfx/layers/ipc/SharedRGBImage.h
index c682e6c3c362..4bc35ade488e 100644
--- a/gfx/layers/ipc/SharedRGBImage.h
+++ b/gfx/layers/ipc/SharedRGBImage.h
@@ -9,7 +9,6 @@
 #include <stdint.h>                     // for uint8_t
 #include "ImageContainer.h"             // for ISharedImage, Image, etc
 #include "gfxTypes.h"
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr
 #include "mozilla/gfx/Point.h"          // for IntSize
@@ -57,7 +56,7 @@ public:
 
   virtual uint8_t *GetBuffer() MOZ_OVERRIDE;
 
-  gfxIntSize GetSize();
+  gfx::IntSize GetSize();
   size_t GetBufferSize();
 
   static uint8_t BytesPerPixel(gfxImageFormat aImageFormat);
@@ -89,7 +88,7 @@ public:
   TextureClient* GetTextureClient() MOZ_OVERRIDE { return nullptr; }
 
 protected:
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
   gfxImageFormat mImageFormat;
   RefPtr<ISurfaceAllocator> mSurfaceAllocator;
 
@@ -114,7 +113,7 @@ public:
 
   virtual uint8_t* GetBuffer() MOZ_OVERRIDE;
 
-  gfxIntSize GetSize();
+  gfx::IntSize GetSize();
 
   size_t GetBufferSize();
 
diff --git a/gfx/layers/opengl/OGLShaderProgram.cpp b/gfx/layers/opengl/OGLShaderProgram.cpp
index f1b7eec4b177..f1436c3d65e0 100644
--- a/gfx/layers/opengl/OGLShaderProgram.cpp
+++ b/gfx/layers/opengl/OGLShaderProgram.cpp
@@ -5,7 +5,6 @@
 #include "OGLShaderProgram.h"
 #include <stdint.h>                     // for uint32_t
 #include "gfxMatrix.h"                  // for gfxMatrix
-#include "gfxPoint.h"                   // for gfxIntSize, gfxPoint, etc
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "nsAString.h"
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 4b0b12391bb4..39d605007ba8 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -105,7 +105,7 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc,
       result = new SharedTextureHostOGL(aFlags,
                                         desc.shareType(),
                                         desc.handle(),
-                                        gfx::ToIntSize(desc.size()),
+                                        desc.size(),
                                         desc.inverted());
       break;
     }
@@ -649,8 +649,7 @@ SharedDeprecatedTextureHostOGL::SwapTexturesImpl(const SurfaceDescriptor& aImage
   SharedTextureDescriptor texture = aImage.get_SharedTextureDescriptor();
 
   SharedTextureHandle newHandle = texture.handle();
-  nsIntSize size = texture.size();
-  mSize = gfx::IntSize(size.width, size.height);
+  mSize = texture.size();
   if (texture.inverted()) {
     mFlags |= TEXTURE_NEEDS_Y_FLIP;
   }
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index ae5ce6fdbeef..6f9a05370177 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1883,7 +1883,7 @@ nsDisplayBackgroundImage::GetLayerState(nsDisplayListBuilder* aBuilder,
   }
 
   if (!animated) {
-    gfxSize imageSize = mImageContainer->GetCurrentSize();
+    mozilla::gfx::IntSize imageSize = mImageContainer->GetCurrentSize();
     NS_ASSERTION(imageSize.width != 0 && imageSize.height != 0, "Invalid image size!");
 
     gfxRect destRect = mDestRect;
@@ -1930,7 +1930,7 @@ nsDisplayBackgroundImage::ConfigureLayer(ImageLayer* aLayer, const nsIntPoint& a
 {
   aLayer->SetFilter(nsLayoutUtils::GetGraphicsFilterForFrame(mFrame));
 
-  gfxIntSize imageSize = mImageContainer->GetCurrentSize();
+  mozilla::gfx::IntSize imageSize = mImageContainer->GetCurrentSize();
   NS_ASSERTION(imageSize.width != 0 && imageSize.height != 0, "Invalid image size!");
 
   gfxMatrix transform;
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 898e2f75df38..61c2664f1288 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -72,6 +72,7 @@
 #include "nsComputedDOMStyle.h"
 #include "ActiveLayerTracker.h"
 #include "mozilla/gfx/2D.h"
+#include "gfx2DGlue.h"
 
 #include "mozilla/Preferences.h"
 
@@ -4961,14 +4962,14 @@ nsLayoutUtils::SurfaceFromElement(HTMLVideoElement* aElement,
   if (!container)
     return result;
 
-  gfxIntSize size;
+  mozilla::gfx::IntSize size;
   nsRefPtr<gfxASurface> surf = container->GetCurrentAsSurface(&size);
   if (!surf)
     return result;
 
   result.mSourceSurface = gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(aTarget, surf);
   result.mCORSUsed = aElement->GetCORSMode() != CORS_NONE;
-  result.mSize = size;
+  result.mSize = ThebesIntSize(size);
   result.mPrincipal = principal.forget();
   result.mIsWriteOnly = false;
 
diff --git a/layout/generic/nsVideoFrame.cpp b/layout/generic/nsVideoFrame.cpp
index b7c020c0ef73..e847f485a61d 100644
--- a/layout/generic/nsVideoFrame.cpp
+++ b/layout/generic/nsVideoFrame.cpp
@@ -179,7 +179,7 @@ nsVideoFrame::BuildLayer(nsDisplayListBuilder* aBuilder,
   
   // Retrieve the size of the decoded video frame, before being scaled
   // by pixel aspect ratio.
-  gfxIntSize frameSize = container->GetCurrentSize();
+  mozilla::gfx::IntSize frameSize = container->GetCurrentSize();
   if (frameSize.width == 0 || frameSize.height == 0) {
     // No image, or zero-sized image. No point creating a layer.
     return nullptr;
diff --git a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
index 0cf31c4da5af..2e2b825c6bde 100644
--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
@@ -39,6 +39,7 @@
 #include "runnable_utils.h"
 #include "gfxImageSurface.h"
 #include "libyuv/convert.h"
+#include "mozilla/gfx/Point.h"
 
 using namespace mozilla;
 
@@ -858,7 +859,7 @@ void MediaPipelineTransmit::PipelineListener::ProcessVideoChunk(
     return;
   }
 
-  gfxIntSize size = img->GetSize();
+  gfx::IntSize size = img->GetSize();
   if ((size.width & 1) != 0 || (size.height & 1) != 0) {
     MOZ_ASSERT(false, "Can't handle odd-sized images");
     return;
@@ -948,7 +949,7 @@ void MediaPipelineTransmit::PipelineListener::ProcessVideoChunk(
     const_cast<layers::CairoImage *>(
           static_cast<const layers::CairoImage *>(img));
 
-    gfxIntSize size = rgb->GetSize();
+    gfx::IntSize size = rgb->GetSize();
     int half_width = (size.width + 1) >> 1;
     int half_height = (size.height + 1) >> 1;
     int c_size = half_width * half_height;

From feefccfd0ceee177b2bf952e4b40c7eb8e2ad5b1 Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:32:06 +0100
Subject: [PATCH 127/144] Bug 929513 - Replace gfxIntSize in
 layers/AutoOpenSurface.h r=nical

This rippled into other replacements in layers and in gfx/gl.
---
 gfx/gl/GLTextureImage.cpp            | 39 +++++++++-------------------
 gfx/gl/GLTextureImage.h              | 25 ++++++------------
 gfx/gl/TextureImageCGL.h             |  2 +-
 gfx/gl/TextureImageCGL.mm            |  2 +-
 gfx/gl/TextureImageEGL.cpp           | 11 ++++----
 gfx/gl/TextureImageEGL.h             |  4 +--
 gfx/layers/ipc/AutoOpenSurface.h     |  2 +-
 gfx/layers/ipc/CompositorParent.cpp  |  6 ++---
 gfx/layers/ipc/ShadowLayers.cpp      |  2 +-
 gfx/layers/opengl/TextureHostOGL.cpp |  2 +-
 10 files changed, 35 insertions(+), 60 deletions(-)

diff --git a/gfx/gl/GLTextureImage.cpp b/gfx/gl/GLTextureImage.cpp
index 36ec89565f39..1fba713c5dec 100644
--- a/gfx/gl/GLTextureImage.cpp
+++ b/gfx/gl/GLTextureImage.cpp
@@ -22,7 +22,7 @@ namespace gl {
 
 already_AddRefed<TextureImage>
 CreateTextureImage(GLContext* gl,
-                   const nsIntSize& aSize,
+                   const gfx::IntSize& aSize,
                    TextureImage::ContentType aContentType,
                    GLenum aWrapMode,
                    TextureImage::Flags aFlags,
@@ -101,7 +101,7 @@ TextureImage::UpdateFromDataSource(gfx::DataSourceSurface *aSurface,
 }
 
 gfx::IntRect TextureImage::GetTileRect() {
-    return gfx::IntRect(gfx::IntPoint(0,0), ToIntSize(mSize));
+    return gfx::IntRect(gfx::IntPoint(0,0), mSize);
 }
 
 gfx::IntRect TextureImage::GetSrcTileRect() {
@@ -133,13 +133,13 @@ BasicTextureImage::BeginUpdate(nsIntRegion& aRegion)
     if (CanUploadSubTextures(mGLContext)) {
         GetUpdateRegion(aRegion);
     } else {
-        aRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
     }
 
     mUpdateRegion = aRegion;
 
     nsIntRect rgnSize = mUpdateRegion.GetBounds();
-    if (!nsIntRect(nsIntPoint(0, 0), mSize).Contains(rgnSize)) {
+    if (!nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize)).Contains(rgnSize)) {
         NS_ERROR("update outside of image");
         return nullptr;
     }
@@ -167,7 +167,7 @@ BasicTextureImage::GetUpdateRegion(nsIntRegion& aForRegion)
   // changed, we need to recreate our backing surface and force the
   // client to paint everything
   if (mTextureState != Valid)
-      aForRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+      aForRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
 }
 
 void
@@ -248,7 +248,7 @@ BasicTextureImage::DirectUpdate(gfxASurface* aSurf, const nsIntRegion& aRegion,
 }
 
 void
-BasicTextureImage::Resize(const nsIntSize& aSize)
+BasicTextureImage::Resize(const gfx::IntSize& aSize)
 {
     NS_ASSERTION(!mUpdateSurface, "Resize() while in update?");
 
@@ -268,13 +268,8 @@ BasicTextureImage::Resize(const nsIntSize& aSize)
     mSize = aSize;
 }
 
-// Moz2D equivalents...
-void TextureImage::Resize(const gfx::IntSize& aSize) {
-  Resize(ThebesIntSize(aSize));
-}
-
 gfx::IntSize TextureImage::GetSize() const {
-  return ToIntSize(mSize);
+  return mSize;
 }
 
 TextureImage::TextureImage(const gfx::IntSize& aSize,
@@ -316,16 +311,6 @@ BasicTextureImage::BasicTextureImage(GLuint aTexture,
   , mUpdateOffset(0, 0)
 {}
 
-already_AddRefed<TextureImage>
-CreateBasicTextureImage(GLContext* aGL,
-                        const gfx::IntSize& aSize,
-                        TextureImage::ContentType aContentType,
-                        GLenum aWrapMode,
-                        TextureImage::Flags aFlags)
-{
-  return CreateBasicTextureImage(aGL, ThebesIntSize(aSize), aContentType, aWrapMode, aFlags);
-}
-
 static bool
 WantsSmallTiles(GLContext* gl)
 {
@@ -345,7 +330,7 @@ WantsSmallTiles(GLContext* gl)
 }
 
 TiledTextureImage::TiledTextureImage(GLContext* aGL,
-                                     nsIntSize aSize,
+                                     gfx::IntSize aSize,
                                      TextureImage::ContentType aContentType,
                                      TextureImage::Flags aFlags,
                                      TextureImage::ImageFormat aImageFormat)
@@ -438,7 +423,7 @@ TiledTextureImage::GetUpdateRegion(nsIntRegion& aForRegion)
         // if the texture hasn't been initialized yet, or something important
         // changed, we need to recreate our backing surface and force the
         // client to paint everything
-        aForRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aForRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
         return;
     }
 
@@ -484,7 +469,7 @@ TiledTextureImage::BeginUpdate(nsIntRegion& aRegion)
         // if the texture hasn't been initialized yet, or something important
         // changed, we need to recreate our backing surface and force the
         // client to paint everything
-        aRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
     }
 
     nsIntRect bounds = aRegion.GetBounds();
@@ -637,7 +622,7 @@ TiledTextureImage::BindTexture(GLenum aTextureUnit)
  * each column, and extra rows are pruned after iteration over the entire image
  * finishes.
  */
-void TiledTextureImage::Resize(const nsIntSize& aSize)
+void TiledTextureImage::Resize(const gfx::IntSize& aSize)
 {
     if (mSize == aSize && mTextureState != Created) {
         return;
@@ -734,7 +719,7 @@ uint32_t TiledTextureImage::GetTileCount()
 
 already_AddRefed<TextureImage>
 CreateBasicTextureImage(GLContext* aGL,
-                        const nsIntSize& aSize,
+                        const gfx::IntSize& aSize,
                         TextureImage::ContentType aContentType,
                         GLenum aWrapMode,
                         TextureImage::Flags aFlags,
diff --git a/gfx/gl/GLTextureImage.h b/gfx/gl/GLTextureImage.h
index efda20554860..6f434b6f262e 100644
--- a/gfx/gl/GLTextureImage.h
+++ b/gfx/gl/GLTextureImage.h
@@ -158,14 +158,12 @@ public:
      * If this isn't implemented by a subclass, it will just perform
      * a dummy BeginUpdate/EndUpdate pair.
      */
-    virtual void Resize(const nsIntSize& aSize) {
+    virtual void Resize(const gfx::IntSize& aSize) {
         mSize = aSize;
         nsIntRegion r(nsIntRect(0, 0, aSize.width, aSize.height));
         BeginUpdate(r);
         EndUpdate();
     }
-    // Moz2D equivalent...
-    void Resize(const gfx::IntSize& aSize);
 
     /**
      * Mark this texture as having valid contents. Call this after modifying
@@ -240,7 +238,7 @@ protected:
 
     virtual gfx::IntRect GetSrcTileRect();
 
-    nsIntSize mSize;
+    gfx::IntSize mSize;
     GLenum mWrapMode;
     ContentType mContentType;
     ImageFormat mImageFormat;
@@ -302,7 +300,7 @@ public:
 
     virtual bool InUpdate() const { return !!mUpdateSurface; }
 
-    virtual void Resize(const nsIntSize& aSize);
+    virtual void Resize(const gfx::IntSize& aSize);
 
 protected:
     GLuint mTexture;
@@ -325,7 +323,7 @@ class TiledTextureImage
 {
 public:
     TiledTextureImage(GLContext* aGL,
-                      nsIntSize aSize,
+                      gfx::IntSize aSize,
                       TextureImage::ContentType,
                       TextureImage::Flags aFlags = TextureImage::NoFlags,
                       TextureImage::ImageFormat aImageFormat = gfxImageFormatUnknown);
@@ -334,7 +332,7 @@ public:
     virtual gfxASurface* BeginUpdate(nsIntRegion& aRegion);
     virtual void GetUpdateRegion(nsIntRegion& aForRegion);
     virtual void EndUpdate();
-    virtual void Resize(const nsIntSize& aSize);
+    virtual void Resize(const gfx::IntSize& aSize);
     virtual uint32_t GetTileCount();
     virtual void BeginTileIteration();
     virtual bool NextTile();
@@ -356,7 +354,7 @@ protected:
     void* mIterationCallbackData;
     nsTArray< nsRefPtr<TextureImage> > mImages;
     bool mInUpdate;
-    nsIntSize mSize;
+    gfx::IntSize mSize;
     unsigned int mTileSize;
     unsigned int mRows, mColumns;
     GLContext* mGL;
@@ -375,19 +373,12 @@ protected:
  */
 already_AddRefed<TextureImage>
 CreateBasicTextureImage(GLContext* aGL,
-                        const nsIntSize& aSize,
+                        const gfx::IntSize& aSize,
                         TextureImage::ContentType aContentType,
                         GLenum aWrapMode,
                         TextureImage::Flags aFlags,
                         TextureImage::ImageFormat aImageFormat = gfxImageFormatUnknown);
 
-already_AddRefed<TextureImage>
-CreateBasicTextureImage(GLContext* aGL,
-                        const gfx::IntSize& aSize,
-                        TextureImage::ContentType aContentType,
-                        GLenum aWrapMode,
-                        TextureImage::Flags aFlags);
-
 /**
   * Return a valid, allocated TextureImage of |aSize| with
   * |aContentType|.  If |aContentType| is COLOR, |aImageFormat| can be used
@@ -406,7 +397,7 @@ CreateBasicTextureImage(GLContext* aGL,
   */
 already_AddRefed<TextureImage>
 CreateTextureImage(GLContext* gl,
-                   const nsIntSize& aSize,
+                   const gfx::IntSize& aSize,
                    TextureImage::ContentType aContentType,
                    GLenum aWrapMode,
                    TextureImage::Flags aFlags = TextureImage::NoFlags,
diff --git a/gfx/gl/TextureImageCGL.h b/gfx/gl/TextureImageCGL.h
index 1f816a9721a0..50490d38b21a 100644
--- a/gfx/gl/TextureImageCGL.h
+++ b/gfx/gl/TextureImageCGL.h
@@ -47,7 +47,7 @@ private:
 
 already_AddRefed<TextureImage>
 CreateTextureImageCGL(GLContext *gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/gl/TextureImageCGL.mm b/gfx/gl/TextureImageCGL.mm
index ff36aac7d8df..e875290a1c6a 100644
--- a/gfx/gl/TextureImageCGL.mm
+++ b/gfx/gl/TextureImageCGL.mm
@@ -108,7 +108,7 @@ TextureImageCGL::FinishedSurfaceUpload()
 
 already_AddRefed<TextureImage>
 CreateTextureImageCGL(GLContext* gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/gl/TextureImageEGL.cpp b/gfx/gl/TextureImageEGL.cpp
index f8277271db01..5bbe85872ce5 100644
--- a/gfx/gl/TextureImageEGL.cpp
+++ b/gfx/gl/TextureImageEGL.cpp
@@ -8,6 +8,7 @@
 #include "GLContext.h"
 #include "GLUploadHelpers.h"
 #include "gfxPlatform.h"
+#include "gfx2DGlue.h"
 #include "mozilla/gfx/Types.h"
 
 namespace mozilla {
@@ -103,7 +104,7 @@ TextureImageEGL::GetUpdateRegion(nsIntRegion& aForRegion)
     if (mTextureState != Valid) {
         // if the texture hasn't been initialized yet, force the
         // client to paint everything
-        aForRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aForRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
     }
 
     // We can only draw a rectangle, not subregions due to
@@ -123,7 +124,7 @@ TextureImageEGL::BeginUpdate(nsIntRegion& aRegion)
     mUpdateRect = aRegion.GetBounds();
 
     //printf_stderr("BeginUpdate with updateRect [%d %d %d %d]\n", mUpdateRect.x, mUpdateRect.y, mUpdateRect.width, mUpdateRect.height);
-    if (!nsIntRect(nsIntPoint(0, 0), mSize).Contains(mUpdateRect)) {
+    if (!nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize)).Contains(mUpdateRect)) {
         NS_ERROR("update outside of image");
         return nullptr;
     }
@@ -173,7 +174,7 @@ TextureImageEGL::EndUpdate()
 
     if (mTextureState != Valid) {
         NS_ASSERTION(mUpdateRect.x == 0 && mUpdateRect.y == 0 &&
-                      mUpdateRect.Size() == mSize,
+                      mUpdateRect.Size() == gfx::ThebesIntSize(mSize),
                       "Bad initial update on non-created texture!");
 
         mGLContext->fTexImage2D(LOCAL_GL_TEXTURE_2D,
@@ -242,7 +243,7 @@ TextureImageEGL::BindTexture(GLenum aTextureUnit)
 }
 
 void
-TextureImageEGL::Resize(const nsIntSize& aSize)
+TextureImageEGL::Resize(const gfx::IntSize& aSize)
 {
     NS_ASSERTION(!mUpdateSurface, "Resize() while in update?");
 
@@ -313,7 +314,7 @@ TextureImageEGL::DestroyEGLSurface(void)
 
 already_AddRefed<TextureImage>
 CreateTextureImageEGL(GLContext *gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/gl/TextureImageEGL.h b/gfx/gl/TextureImageEGL.h
index 71e99e1ddc06..89d273f84ae5 100644
--- a/gfx/gl/TextureImageEGL.h
+++ b/gfx/gl/TextureImageEGL.h
@@ -47,7 +47,7 @@ public:
 
     virtual bool InUpdate() const { return !!mUpdateSurface; }
 
-    virtual void Resize(const nsIntSize& aSize);
+    virtual void Resize(const gfx::IntSize& aSize);
 
     bool BindTexImage();
 
@@ -79,7 +79,7 @@ protected:
 
 already_AddRefed<TextureImage>
 CreateTextureImageEGL(GLContext *gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/layers/ipc/AutoOpenSurface.h b/gfx/layers/ipc/AutoOpenSurface.h
index 4ee35bb61af0..785f668d19ff 100644
--- a/gfx/layers/ipc/AutoOpenSurface.h
+++ b/gfx/layers/ipc/AutoOpenSurface.h
@@ -39,7 +39,7 @@ public:
    */
   gfxContentType ContentType();
   gfxImageFormat ImageFormat();
-  gfxIntSize Size();
+  gfx::IntSize Size();
 
   /** This can't escape the scope of AutoOpenSurface. */
   gfxASurface* Get();
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index d848e61d9ca7..079c9891b0ff 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -312,13 +312,11 @@ CompositorParent::RecvMakeSnapshot(const SurfaceDescriptor& aInSnapshot,
                                    SurfaceDescriptor* aOutSnapshot)
 {
   AutoOpenSurface opener(OPEN_READ_WRITE, aInSnapshot);
-  gfxIntSize size = opener.Size();
+  gfx::IntSize size = opener.Size();
   // XXX CreateDrawTargetForSurface will always give us a Cairo surface, we can
   // do better if AutoOpenSurface uses Moz2D directly.
   RefPtr<DrawTarget> target =
-    gfxPlatform::GetPlatform()->CreateDrawTargetForSurface(opener.Get(),
-                                                           IntSize(size.width,
-                                                                   size.height));
+    gfxPlatform::GetPlatform()->CreateDrawTargetForSurface(opener.Get(), size);
   ComposeToTarget(target);
   *aOutSnapshot = aInSnapshot;
   return true;
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index ae00a6093bac..ed9cdf167e0b 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -822,7 +822,7 @@ AutoOpenSurface::ImageFormat()
     mDescriptor, mMode, getter_AddRefs(mSurface));
 }
 
-gfxIntSize
+gfx::IntSize
 AutoOpenSurface::Size()
 {
   if (mSurface) {
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 39d605007ba8..16be30f5dabe 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -552,7 +552,7 @@ TextureImageDeprecatedTextureHostOGL::UpdateImpl(const SurfaceDescriptor& aImage
 #endif
 
   AutoOpenSurface surf(OPEN_READ_ONLY, aImage);
-  nsIntSize size = surf.Size();
+  gfx::IntSize size = surf.Size();
   TextureImage::ImageFormat format = surf.ImageFormat();
 
   if (!mTexture ||

From a5d20cf034a8efbc02f42c59fdf3db8d7b86a9fc Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:32:10 +0100
Subject: [PATCH 128/144] Bug 929513 - Fix compile errors on Windows/Android
 r=nical

Forgot an include in the ImageLayerD3D9.cpp file (though I am unable to
reproduce the issue on my own windows installation).

Also seems in my previous attempt to fix the build, I introduced a
breakage for Android. Hopefully this will fix things.
---
 content/media/plugins/MediaPluginReader.cpp | 3 ++-
 gfx/layers/d3d9/ImageLayerD3D9.cpp          | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/content/media/plugins/MediaPluginReader.cpp b/content/media/plugins/MediaPluginReader.cpp
index be6b8762bf21..a76950f9428e 100644
--- a/content/media/plugins/MediaPluginReader.cpp
+++ b/content/media/plugins/MediaPluginReader.cpp
@@ -6,6 +6,7 @@
 #include "MediaPluginReader.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/dom/TimeRanges.h"
+#include "mozilla/gfx/Point.h"
 #include "MediaResource.h"
 #include "VideoUtils.h"
 #include "MediaPluginDecoder.h"
@@ -172,7 +173,7 @@ bool MediaPluginReader::DecodeVideoFrame(bool &aKeyframeSkip,
  
     nsAutoPtr<VideoData> v;
     if (currentImage) {
-      gfxIntSize frameSize = currentImage->GetSize();
+      gfx::IntSize frameSize = currentImage->GetSize();
       if (frameSize.width != mInitialFrame.width ||
           frameSize.height != mInitialFrame.height) {
         // Frame size is different from what the container reports. This is legal,
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index 43a1527fc520..e6b58cb72048 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -11,6 +11,7 @@
 #include "ThebesLayerD3D9.h"
 #include "gfxPlatform.h"
 #include "gfxImageSurface.h"
+#include "gfx2DGlue.h"
 #include "yuv_convert.h"
 #include "nsIServiceManager.h"
 #include "nsIConsoleService.h"

From 6f30920da5ed9a6c920bbeac2eb66e2e92bc61d7 Mon Sep 17 00:00:00 2001
From: Quentin Headen <qheaden@phaseshiftsoftware.com>
Date: Fri, 13 Dec 2013 12:42:43 -0500
Subject: [PATCH 129/144] Bug 731667 - Rewrite mtable implementation to avoid
 use of _moz-* attributes - implement parsing and rendering. r=karlt, r=bz

---
 layout/generic/nsBlockFrame.cpp       |   7 +
 layout/generic/nsBlockFrame.h         |   8 +
 layout/generic/nsLineLayout.cpp       |  10 +-
 layout/mathml/nsMathMLmtableFrame.cpp | 577 +++++++++++++++-----------
 layout/mathml/nsMathMLmtableFrame.h   |  13 +-
 layout/tables/nsTableCellFrame.cpp    |  24 +-
 layout/tables/nsTableCellFrame.h      |   7 +-
 7 files changed, 398 insertions(+), 248 deletions(-)

diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 4a59b02484f8..2f4244b1f201 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -5706,6 +5706,13 @@ nsBlockFrame::DeleteNextInFlowChild(nsPresContext* aPresContext,
   }
 }
 
+const nsStyleText*
+nsBlockFrame::StyleTextForLineLayout()
+{
+  // Return the pointer to an unmodified style text
+  return StyleText();
+}
+
 ////////////////////////////////////////////////////////////////////////
 // Float support
 
diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
index b5aedcbb08a3..d063c9346d7e 100644
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -314,6 +314,14 @@ public:
                                      nsIFrame*      aNextInFlow,
                                      bool           aDeletingEmptyFrames) MOZ_OVERRIDE;
 
+  /**
+    * This is a special method that allows a child class of nsBlockFrame to
+    * return a special, customized nsStyleText object to the nsLineLayout
+    * constructor. It is used when the nsBlockFrame child needs to specify its
+    * custom rendering style.
+    */
+  virtual const nsStyleText* StyleTextForLineLayout();
+
   /**
    * Determines whether the collapsed margin carried out of the last
    * line includes the margin-top of a line with clearance (in which
diff --git a/layout/generic/nsLineLayout.cpp b/layout/generic/nsLineLayout.cpp
index 630e5b738e06..a0073b572343 100644
--- a/layout/generic/nsLineLayout.cpp
+++ b/layout/generic/nsLineLayout.cpp
@@ -82,7 +82,12 @@ nsLineLayout::nsLineLayout(nsPresContext* aPresContext,
   MOZ_COUNT_CTOR(nsLineLayout);
 
   // Stash away some style data that we need
-  mStyleText = aOuterReflowState->frame->StyleText();
+  nsBlockFrame* blockFrame = do_QueryFrame(aOuterReflowState->frame);
+  if (blockFrame)
+    mStyleText = blockFrame->StyleTextForLineLayout();
+  else
+    mStyleText = aOuterReflowState->frame->StyleText();
+
   mLineNumber = 0;
   mTotalPlacedFrames = 0;
   mTopEdge = 0;
@@ -201,7 +206,8 @@ nsLineLayout::BeginLineReflow(nscoord aX, nscoord aY,
 
   mTopEdge = aY;
 
-  psd->mNoWrap = !mStyleText->WhiteSpaceCanWrap(LineContainerFrame());
+  psd->mNoWrap =
+    !mStyleText->WhiteSpaceCanWrapStyle() || LineContainerFrame()->IsSVGText();
   psd->mDirection = aDirection;
   psd->mChangedFrameDirection = false;
 
diff --git a/layout/mathml/nsMathMLmtableFrame.cpp b/layout/mathml/nsMathMLmtableFrame.cpp
index 5095ad1ec2a7..86870f2fb506 100644
--- a/layout/mathml/nsMathMLmtableFrame.cpp
+++ b/layout/mathml/nsMathMLmtableFrame.cpp
@@ -9,6 +9,7 @@
 #include "nsStyleConsts.h"
 #include "nsINameSpaceManager.h"
 #include "nsRenderingContext.h"
+#include "nsCSSRendering.h"
 
 #include "nsTArray.h"
 #include "nsTableFrame.h"
@@ -17,74 +18,127 @@
 #include "RestyleManager.h"
 #include <algorithm>
 
+#include "nsIScriptError.h"
+#include "nsContentUtils.h"
+
 using namespace mozilla;
 
 //
 // <mtable> -- table or matrix - implementation
 //
 
-// helper function to perform an in-place split of a space-delimited string,
-// and return an array of pointers for the beginning of each segment, i.e.,
-// aOffset[0] is the first string, aOffset[1] is the second string, etc.
-// Used to parse attributes like columnalign='left right', rowalign='top bottom'
-static void
-SplitString(nsString&             aString, // [IN/OUT]
-            nsTArray<PRUnichar*>& aOffset) // [OUT]
+static int8_t
+ParseStyleValue(nsIAtom* aAttribute, const nsAString& aAttributeValue)
 {
-  static const PRUnichar kNullCh = PRUnichar('\0');
-
-  aString.Append(kNullCh);  // put an extra null at the end
-
-  PRUnichar* start = aString.BeginWriting();
-  PRUnichar* end   = start;
-
-  while (kNullCh != *start) {
-    while ((kNullCh != *start) && nsCRT::IsAsciiSpace(*start)) {  // skip leading space
-      start++;
-    }
-    end = start;
-
-    while ((kNullCh != *end) && (false == nsCRT::IsAsciiSpace(*end))) { // look for space or end
-      end++;
-    }
-    *end = kNullCh; // end string here
-
-    if (start < end) {
-      aOffset.AppendElement(start); // record the beginning of this segment
-    }
-
-    start = ++end;
+  if (aAttribute == nsGkAtoms::rowalign_) {
+    if (aAttributeValue.EqualsLiteral("top"))
+      return NS_STYLE_VERTICAL_ALIGN_TOP;
+    else if (aAttributeValue.EqualsLiteral("bottom"))
+      return NS_STYLE_VERTICAL_ALIGN_BOTTOM;
+    else if (aAttributeValue.EqualsLiteral("center"))
+      return NS_STYLE_VERTICAL_ALIGN_MIDDLE;
+    else
+      return NS_STYLE_VERTICAL_ALIGN_BASELINE;
+  } else if (aAttribute == nsGkAtoms::columnalign_) {
+    if (aAttributeValue.EqualsLiteral("left"))
+      return NS_STYLE_TEXT_ALIGN_LEFT;
+    else if (aAttributeValue.EqualsLiteral("right"))
+      return NS_STYLE_TEXT_ALIGN_RIGHT;
+    else
+      return NS_STYLE_TEXT_ALIGN_CENTER;
+  } else if (aAttribute == nsGkAtoms::rowlines_ ||
+             aAttribute == nsGkAtoms::columnlines_) {
+    if (aAttributeValue.EqualsLiteral("solid"))
+      return NS_STYLE_BORDER_STYLE_SOLID;
+    else if (aAttributeValue.EqualsLiteral("dashed"))
+      return NS_STYLE_BORDER_STYLE_DASHED;
+    else
+      return NS_STYLE_BORDER_STYLE_NONE;
+  } else {
+    MOZ_CRASH("Unrecognized attribute.");
   }
+
+  return -1;
 }
 
-struct nsValueList
+static nsTArray<int8_t>*
+ExtractStyleValues(const nsAString& aString, nsIAtom* aAttribute,
+                   bool aAllowMultiValues)
 {
-  nsString             mData;
-  nsTArray<PRUnichar*> mArray;
+  nsTArray<int8_t>* styleArray = nullptr;
 
-  nsValueList(nsString& aData) {
-    mData.Assign(aData);
-    SplitString(mData, mArray);
+  const PRUnichar* start = aString.BeginReading();
+  const PRUnichar* end = aString.EndReading();
+
+  int32_t startIndex = 0;
+  int32_t count = 0;
+
+  while (start < end) {
+    // Skip leading spaces.
+    while ((start < end) && nsCRT::IsAsciiSpace(*start)) {
+      start++;
+      startIndex++;
+    }
+
+    // Look for the end of the string, or another space.
+    while ((start < end) && !nsCRT::IsAsciiSpace(*start)) {
+      start++;
+      count++;
+    }
+
+    // Grab the value found and process it.
+    if (count > 0) {
+      if (!styleArray)
+        styleArray = new nsTArray<int8_t>();
+
+      // We want to return a null array if an attribute gives multiple values,
+      // but multiple values aren't allowed.
+      if (styleArray->Length() > 1 && !aAllowMultiValues) {
+        delete styleArray;
+        return nullptr;
+      }
+
+      nsDependentSubstring valueString(aString, startIndex, count);
+      int8_t styleValue = ParseStyleValue(aAttribute, valueString);
+      styleArray->AppendElement(styleValue);
+
+      startIndex += count;
+      count = 0;
+    }
   }
-};
+  return styleArray;
+}
+
+static nsresult ReportParseError(nsIFrame* aFrame, const PRUnichar* aAttribute,
+                                 const PRUnichar* aValue)
+{
+  nsIContent* content = aFrame->GetContent();
+
+  const PRUnichar* params[] =
+    { aValue, aAttribute, content->Tag()->GetUTF16String() };
+
+  return nsContentUtils::ReportToConsole(nsIScriptError::errorFlag,
+                                         NS_LITERAL_CSTRING("MathML"),
+                                         content->OwnerDoc(),
+                                         nsContentUtils::eMATHML_PROPERTIES,
+                                         "AttributeParsingError", params, 3);
+}
 
 // Each rowalign='top bottom' or columnalign='left right center' (from
-// <mtable> or <mtr>) is split once (lazily) into a nsValueList which is
+// <mtable> or <mtr>) is split once into an nsTArray<int8_t> which is
 // stored in the property table. Row/Cell frames query the property table
 // to see what values apply to them.
 
-// XXX See bug 69409 - MathML attributes are not mapped to style.
-
 static void
-DestroyValueList(void* aPropertyValue)
+DestroyStylePropertyList(void* aPropertyValue)
 {
-  delete static_cast<nsValueList*>(aPropertyValue);
+  delete static_cast<nsTArray<int8_t>*>(aPropertyValue);
 }
 
-NS_DECLARE_FRAME_PROPERTY(RowAlignProperty, DestroyValueList)
-NS_DECLARE_FRAME_PROPERTY(RowLinesProperty, DestroyValueList)
-NS_DECLARE_FRAME_PROPERTY(ColumnAlignProperty, DestroyValueList)
-NS_DECLARE_FRAME_PROPERTY(ColumnLinesProperty, DestroyValueList)
+NS_DECLARE_FRAME_PROPERTY(RowAlignProperty, DestroyStylePropertyList)
+NS_DECLARE_FRAME_PROPERTY(RowLinesProperty, DestroyStylePropertyList)
+NS_DECLARE_FRAME_PROPERTY(ColumnAlignProperty, DestroyStylePropertyList)
+NS_DECLARE_FRAME_PROPERTY(ColumnLinesProperty, DestroyStylePropertyList)
 
 static const FramePropertyDescriptor*
 AttributeToProperty(nsIAtom* aAttribute)
@@ -99,141 +153,132 @@ AttributeToProperty(nsIAtom* aAttribute)
   return ColumnLinesProperty();
 }
 
-static PRUnichar*
-GetValueAt(nsIFrame*                      aTableOrRowFrame,
-           const FramePropertyDescriptor* aProperty,
-           nsIAtom*                       aAttribute,
-           int32_t                        aRowOrColIndex)
+/* This method looks for a property that applies to a cell, but it looks
+ * recursively because some cell properties can come from the cell, a row,
+ * a table, etc. This function searches through the heirarchy for a property
+ * and returns its value. The function stops searching after checking a <mtable>
+ * frame.
+ */
+static nsTArray<int8_t>*
+FindCellProperty(const nsIFrame* aCellFrame,
+                 const FramePropertyDescriptor* aFrameProperty)
 {
-  FrameProperties props = aTableOrRowFrame->Properties();
-  nsValueList* valueList = static_cast<nsValueList*>(props.Get(aProperty));
-  if (!valueList) {
-    // The property isn't there yet, so set it
-    nsAutoString values;
-    aTableOrRowFrame->GetContent()->GetAttr(kNameSpaceID_None, aAttribute, values);
-    if (!values.IsEmpty())
-      valueList = new nsValueList(values);
-    if (!valueList || !valueList->mArray.Length()) {
-      delete valueList; // ok either way, delete is null safe
-      return nullptr;
-    }
-    props.Set(aProperty, valueList);
+  const nsIFrame* currentFrame = aCellFrame;
+  nsTArray<int8_t>* propertyData = nullptr;
+
+  while (currentFrame) {
+    FrameProperties props = currentFrame->Properties();
+    propertyData = static_cast<nsTArray<int8_t>*>(props.Get(aFrameProperty));
+    bool frameIsTable = (currentFrame->GetType() == nsGkAtoms::tableFrame);
+
+    if (propertyData || frameIsTable)
+      currentFrame = nullptr; // A null frame pointer exits the loop
+    else
+      currentFrame = currentFrame->GetParent(); // Go to the parent frame
   }
-  int32_t count = valueList->mArray.Length();
-  return (aRowOrColIndex < count)
-         ? valueList->mArray[aRowOrColIndex]
-         : valueList->mArray[count-1];
+
+  return propertyData;
 }
 
+/*
+ * A variant of the nsDisplayBorder contains special code to render a border
+ * around a nsMathMLmtdFrame based on the rowline and columnline properties
+ * set on the cell frame.
+ */
+class nsDisplaymtdBorder : public nsDisplayBorder {
+public:
+  nsDisplaymtdBorder(nsDisplayListBuilder* aBuilder, nsMathMLmtdFrame* aFrame)
+    : nsDisplayBorder(aBuilder, aFrame)
+  {
+  }
+
+  virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx) MOZ_OVERRIDE
+  {
+    int32_t rowIndex;
+    int32_t columnIndex;
+    static_cast<nsTableCellFrame*>(mFrame)->
+      GetCellIndexes(rowIndex, columnIndex);
+
+    nsStyleBorder styleBorder = *mFrame->StyleBorder();
+    nscoord borderWidth =
+      mFrame->PresContext()->GetBorderWidthTable()[NS_STYLE_BORDER_WIDTH_THIN];
+
+    nsTArray<int8_t>* rowLinesList =
+      FindCellProperty(mFrame, RowLinesProperty());
+
+    nsTArray<int8_t>* columnLinesList =
+      FindCellProperty(mFrame, ColumnLinesProperty());
+
+    // We don't place a row line on top of the first row
+    if (rowIndex > 0 && rowLinesList) {
+      // If the row number is greater than the number of provided rowline
+      // values, we simply repeat the last value.
+      int32_t listLength = rowLinesList->Length();
+      if (rowIndex < listLength) {
+        styleBorder.SetBorderStyle(NS_SIDE_TOP,
+                      rowLinesList->ElementAt(rowIndex - 1));
+      } else {
+        styleBorder.SetBorderStyle(NS_SIDE_TOP,
+                      rowLinesList->ElementAt(listLength - 1));
+      }
+      styleBorder.SetBorderWidth(NS_SIDE_TOP, borderWidth);
+    }
+
+    // We don't place a column line on the left of the first column.
+    if (columnIndex > 0 && columnLinesList) {
+      // If the column number is greater than the number of provided columline
+      // values, we simply repeat the last value.
+      int32_t listLength = columnLinesList->Length();
+      if (columnIndex < listLength) {
+        styleBorder.SetBorderStyle(NS_SIDE_LEFT,
+                      columnLinesList->ElementAt(columnIndex - 1));
+      } else {
+        styleBorder.SetBorderStyle(NS_SIDE_LEFT,
+                      columnLinesList->ElementAt(listLength - 1));
+      }
+      styleBorder.SetBorderWidth(NS_SIDE_LEFT, borderWidth);
+    }
+
+    nsPoint offset = ToReferenceFrame();
+    nsCSSRendering::PaintBorderWithStyleBorder(mFrame->PresContext(), *aCtx,
+                                               mFrame, mVisibleRect,
+                                               nsRect(offset,
+                                                      mFrame->GetSize()),
+                                               styleBorder,
+                                               mFrame->StyleContext(),
+                                               mFrame->GetSkipSides());
+  }
+};
+
 #ifdef DEBUG
-static bool
-IsTable(uint8_t aDisplay)
-{
-  if ((aDisplay == NS_STYLE_DISPLAY_TABLE) ||
-      (aDisplay == NS_STYLE_DISPLAY_INLINE_TABLE))
-    return true;
-  return false;
-}
-
 #define DEBUG_VERIFY_THAT_FRAME_IS(_frame, _expected) \
   NS_ASSERTION(NS_STYLE_DISPLAY_##_expected == _frame->StyleDisplay()->mDisplay, "internal error");
-#define DEBUG_VERIFY_THAT_FRAME_IS_TABLE(_frame) \
-  NS_ASSERTION(IsTable(_frame->StyleDisplay()->mDisplay), "internal error");
 #else
 #define DEBUG_VERIFY_THAT_FRAME_IS(_frame, _expected)
-#define DEBUG_VERIFY_THAT_FRAME_IS_TABLE(_frame)
 #endif
 
-// map attributes that depend on the index of the row:
-// rowalign, rowlines, XXX need rowspacing too
 static void
-MapRowAttributesIntoCSS(nsIFrame* aTableFrame,
-                        nsIFrame* aRowFrame)
+ParseFrameAttribute(nsIFrame* aFrame, nsIAtom* aAttribute,
+                    bool aAllowMultiValues)
 {
-  DEBUG_VERIFY_THAT_FRAME_IS_TABLE(aTableFrame);
-  DEBUG_VERIFY_THAT_FRAME_IS(aRowFrame, TABLE_ROW);
-  int32_t rowIndex = ((nsTableRowFrame*)aRowFrame)->GetRowIndex();
-  nsIContent* rowContent = aRowFrame->GetContent();
-  PRUnichar* attr;
+  nsAutoString attrValue;
 
-  // see if the rowalign attribute is not already set
-  if (!rowContent->HasAttr(kNameSpaceID_None, nsGkAtoms::rowalign_) &&
-      !rowContent->HasAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowalign_)) {
-    // see if the rowalign attribute was specified on the table
-    attr = GetValueAt(aTableFrame, RowAlignProperty(),
-                      nsGkAtoms::rowalign_, rowIndex);
-    if (attr) {
-      // set our special _moz attribute on the row without notifying a reflow
-      rowContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowalign_,
-                          nsDependentString(attr), false);
-    }
-  }
+  nsIContent* frameContent = aFrame->GetContent();
+  frameContent->GetAttr(kNameSpaceID_None, aAttribute, attrValue);
 
-  // if we are not on the first row, see if |rowlines| was specified on the table.
-  // Note that we pass 'rowIndex-1' because the CSS rule in mathml.css is associated
-  // to 'border-top', and it is as if we draw the line on behalf of the previous cell.
-  // This way of doing so allows us to handle selective lines, [row]\hline[row][row]',
-  // and cases of spanning cells without further complications.
-  if (rowIndex > 0 &&
-      !rowContent->HasAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowline_)) {
-    attr = GetValueAt(aTableFrame, RowLinesProperty(),
-                      nsGkAtoms::rowlines_, rowIndex-1);
-    if (attr) {
-      // set our special _moz attribute on the row without notifying a reflow
-      rowContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowline_,
-                          nsDependentString(attr), false);
-    }
-  }
-}
+  if (!attrValue.IsEmpty()) {
+    nsTArray<int8_t>* valueList =
+      ExtractStyleValues(attrValue, aAttribute, aAllowMultiValues);
 
-// map attributes that depend on the index of the column:
-// columnalign, columnlines, XXX need columnwidth and columnspacing too
-static void
-MapColAttributesIntoCSS(nsIFrame* aTableFrame,
-                        nsIFrame* aRowFrame,
-                        nsIFrame* aCellFrame)
-{
-  DEBUG_VERIFY_THAT_FRAME_IS_TABLE(aTableFrame);
-  DEBUG_VERIFY_THAT_FRAME_IS(aRowFrame, TABLE_ROW);
-  DEBUG_VERIFY_THAT_FRAME_IS(aCellFrame, TABLE_CELL);
-  int32_t rowIndex, colIndex;
-  ((nsTableCellFrame*)aCellFrame)->GetCellIndexes(rowIndex, colIndex);
-  nsIContent* cellContent = aCellFrame->GetContent();
-  PRUnichar* attr;
-
-  // see if the columnalign attribute is not already set
-  if (!cellContent->HasAttr(kNameSpaceID_None, nsGkAtoms::columnalign_) &&
-      !cellContent->HasAttr(kNameSpaceID_None,
-                            nsGkAtoms::_moz_math_columnalign_)) {
-    // see if the columnalign attribute was specified on the row
-    attr = GetValueAt(aRowFrame, ColumnAlignProperty(),
-                      nsGkAtoms::columnalign_, colIndex);
-    if (!attr) {
-      // see if the columnalign attribute was specified on the table
-      attr = GetValueAt(aTableFrame, ColumnAlignProperty(),
-                        nsGkAtoms::columnalign_, colIndex);
-    }
-    if (attr) {
-      // set our special _moz attribute without notifying a reflow
-      cellContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnalign_,
-                           nsDependentString(attr), false);
-    }
-  }
-
-  // if we are not on the first column, see if |columnlines| was specified on
-  // the table. Note that we pass 'colIndex-1' because the CSS rule in mathml.css
-  // is associated to 'border-left', and it is as if we draw the line on behalf
-  // of the previous cell. This way of doing so allows us to handle selective lines,
-  // e.g., 'r|cl', and cases of spanning cells without further complications.
-  if (colIndex > 0 &&
-      !cellContent->HasAttr(kNameSpaceID_None,
-                            nsGkAtoms::_moz_math_columnline_)) {
-    attr = GetValueAt(aTableFrame, ColumnLinesProperty(),
-                      nsGkAtoms::columnlines_, colIndex-1);
-    if (attr) {
-      // set our special _moz attribute without notifying a reflow
-      cellContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnline_,
-                           nsDependentString(attr), false);
+    // If valueList is null, that indicates a problem with the attribute value.
+    // Only set properties on a valid attribute value.
+    if (valueList) {
+      // The code reading the property assumes that this list is nonempty.
+      NS_ASSERTION(valueList->Length() >= 1, "valueList should not be empty!");
+      FrameProperties props = aFrame->Properties();
+      props.Set(AttributeToProperty(aAttribute), valueList);
+    } else {
+      ReportParseError(aFrame, aAttribute->GetUTF16String(), attrValue.get());
     }
   }
 }
@@ -243,6 +288,14 @@ MapColAttributesIntoCSS(nsIFrame* aTableFrame,
 static void
 MapAllAttributesIntoCSS(nsIFrame* aTableFrame)
 {
+  // Map mtable rowalign & rowlines.
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::rowalign_, true);
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::rowlines_, true);
+
+  // Map mtable columnalign & columnlines.
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::columnalign_, true);
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::columnlines_, true);
+
   // mtable is simple and only has one (pseudo) row-group
   nsIFrame* rgFrame = aTableFrame->GetFirstPrincipalChild();
   if (!rgFrame || rgFrame->GetType() != nsGkAtoms::tableRowGroupFrame)
@@ -252,12 +305,19 @@ MapAllAttributesIntoCSS(nsIFrame* aTableFrame)
   for ( ; rowFrame; rowFrame = rowFrame->GetNextSibling()) {
     DEBUG_VERIFY_THAT_FRAME_IS(rowFrame, TABLE_ROW);
     if (rowFrame->GetType() == nsGkAtoms::tableRowFrame) {
-      MapRowAttributesIntoCSS(aTableFrame, rowFrame);
+      // Map row rowalign.
+      ParseFrameAttribute(rowFrame, nsGkAtoms::rowalign_, false);
+      // Map row columnalign.
+      ParseFrameAttribute(rowFrame, nsGkAtoms::columnalign_, true);
+
       nsIFrame* cellFrame = rowFrame->GetFirstPrincipalChild();
       for ( ; cellFrame; cellFrame = cellFrame->GetNextSibling()) {
         DEBUG_VERIFY_THAT_FRAME_IS(cellFrame, TABLE_CELL);
         if (IS_TABLE_CELL(cellFrame->GetType())) {
-          MapColAttributesIntoCSS(aTableFrame, rowFrame, cellFrame);
+          // Map cell rowalign.
+          ParseFrameAttribute(cellFrame, nsGkAtoms::rowalign_, false);
+          // Map row columnalign.
+          ParseFrameAttribute(cellFrame, nsGkAtoms::columnalign_, false);
         }
       }
     }
@@ -457,48 +517,27 @@ nsMathMLmtableOuterFrame::AttributeChanged(int32_t  aNameSpaceID,
   }
 
   // ...and the other attributes affect rows or columns in one way or another
-  nsIAtom* MOZrowAtom = nullptr;
-  nsIAtom* MOZcolAtom = nullptr;
-  if (aAttribute == nsGkAtoms::rowalign_)
-    MOZrowAtom = nsGkAtoms::_moz_math_rowalign_;
-  else if (aAttribute == nsGkAtoms::rowlines_)
-    MOZrowAtom = nsGkAtoms::_moz_math_rowline_;
-  else if (aAttribute == nsGkAtoms::columnalign_)
-    MOZcolAtom = nsGkAtoms::_moz_math_columnalign_;
-  else if (aAttribute == nsGkAtoms::columnlines_)
-    MOZcolAtom = nsGkAtoms::_moz_math_columnline_;
 
-  if (!MOZrowAtom && !MOZcolAtom)
+  // Ignore attributes that do not affect layout.
+  if (aAttribute != nsGkAtoms::rowalign_ &&
+      aAttribute != nsGkAtoms::rowlines_ &&
+      aAttribute != nsGkAtoms::columnalign_ &&
+      aAttribute != nsGkAtoms::columnlines_) {
     return NS_OK;
+  }
 
   nsPresContext* presContext = tableFrame->PresContext();
-  // clear any cached nsValueList for this table
+
+  // clear any cached property list for this table
   presContext->PropertyTable()->
     Delete(tableFrame, AttributeToProperty(aAttribute));
 
-  // unset any _moz attribute that we may have set earlier, and re-sync
-  nsIFrame* rowFrame = rgFrame->GetFirstPrincipalChild();
-  for ( ; rowFrame; rowFrame = rowFrame->GetNextSibling()) {
-    if (rowFrame->GetType() == nsGkAtoms::tableRowFrame) {
-      if (MOZrowAtom) { // let rows do the work
-        rowFrame->GetContent()->UnsetAttr(kNameSpaceID_None, MOZrowAtom, false);
-        MapRowAttributesIntoCSS(tableFrame, rowFrame);    
-      } else { // let cells do the work
-        nsIFrame* cellFrame = rowFrame->GetFirstPrincipalChild();
-        for ( ; cellFrame; cellFrame = cellFrame->GetNextSibling()) {
-          if (IS_TABLE_CELL(cellFrame->GetType())) {
-            cellFrame->GetContent()->UnsetAttr(kNameSpaceID_None, MOZcolAtom, false);
-            MapColAttributesIntoCSS(tableFrame, rowFrame, cellFrame);
-          }
-        }
-      }
-    }
-  }
+  // Reparse the new attribute on the table.
+  ParseFrameAttribute(tableFrame, aAttribute, true);
 
-  // Explicitly request a re-resolve and reflow in our subtree to pick up any changes
-  presContext->RestyleManager()->
-    PostRestyleEvent(mContent->AsElement(), eRestyle_Subtree,
-                     nsChangeHint_AllReflowHints);
+  // Explicitly request a reflow in our subtree to pick up any changes
+  presContext->PresShell()->
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
@@ -704,43 +743,26 @@ nsMathMLmtrFrame::AttributeChanged(int32_t  aNameSpaceID,
 {
   // Attributes specific to <mtr>:
   // groupalign  : Not yet supported.
-  // rowalign    : Fully specified in mathml.css, and so HasAttributeDependentStyle() will
-  //               pick it up and RestyleManager will issue a PostRestyleEvent().
-  // columnalign : Need an explicit re-style call.
-
-  if (aAttribute == nsGkAtoms::rowalign_) {
-    // unset any _moz attribute that we may have set earlier, and re-sync
-    mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowalign_,
-                        false);
-    MapRowAttributesIntoCSS(nsTableFrame::GetTableFrame(this), this);
-    // That's all - see comment above.
-    return NS_OK;
-  }
-
-  if (aAttribute != nsGkAtoms::columnalign_)
-    return NS_OK;
+  // rowalign    : Here
+  // columnalign : Here
 
   nsPresContext* presContext = PresContext();
-  // Clear any cached columnalign's nsValueList for this row
-  presContext->PropertyTable()->Delete(this, AttributeToProperty(aAttribute));
 
-  // Clear any internal _moz attribute that we may have set earlier
-  // in our cells and re-sync their columnalign attribute
-  nsTableFrame* tableFrame = nsTableFrame::GetTableFrame(this);
-  nsIFrame* cellFrame = GetFirstPrincipalChild();
-  for ( ; cellFrame; cellFrame = cellFrame->GetNextSibling()) {
-    if (IS_TABLE_CELL(cellFrame->GetType())) {
-      cellFrame->GetContent()->
-        UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnalign_,
-                  false);
-      MapColAttributesIntoCSS(tableFrame, this, cellFrame);
-    }
+  if (aAttribute != nsGkAtoms::rowalign_ &&
+      aAttribute != nsGkAtoms::columnalign_) {
+    return NS_OK;
   }
 
-  // Explicitly request a re-resolve and reflow in our subtree to pick up any changes
-  presContext->RestyleManager()->
-    PostRestyleEvent(mContent->AsElement(), eRestyle_Subtree,
-                     nsChangeHint_AllReflowHints);
+  presContext->PropertyTable()->Delete(this, AttributeToProperty(aAttribute));
+
+  bool allowMultiValues = (aAttribute == nsGkAtoms::columnalign_);
+
+  // Reparse the new attribute.
+  ParseFrameAttribute(this, aAttribute, allowMultiValues);
+
+  // Explicitly request a reflow in our subtree to pick up any changes
+  presContext->PresShell()->
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
@@ -806,16 +828,19 @@ nsMathMLmtdFrame::AttributeChanged(int32_t  aNameSpaceID,
 {
   // Attributes specific to <mtd>:
   // groupalign  : Not yet supported
-  // rowalign    : in mathml.css
+  // rowalign    : here
   // columnalign : here
   // rowspan     : here
   // columnspan  : here
 
-  if (aAttribute == nsGkAtoms::columnalign_) {
-    // unset any _moz attribute that we may have set earlier, and re-sync
-    mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnalign_,
-                        false);
-    MapColAttributesIntoCSS(nsTableFrame::GetTableFrame(this), mParent, this);
+  if (aAttribute == nsGkAtoms::rowalign_ ||
+      aAttribute == nsGkAtoms::columnalign_) {
+
+    nsPresContext* presContext = PresContext();
+    presContext->PropertyTable()->Delete(this, AttributeToProperty(aAttribute));
+
+    // Reparse the attribute.
+    ParseFrameAttribute(this, aAttribute, false);
     return NS_OK;
   }
 
@@ -830,6 +855,38 @@ nsMathMLmtdFrame::AttributeChanged(int32_t  aNameSpaceID,
   return NS_OK;
 }
 
+uint8_t
+nsMathMLmtdFrame::GetVerticalAlign() const
+{
+  // Set the default alignment in case no alignment was specified
+  uint8_t alignment = nsTableCellFrame::GetVerticalAlign();
+
+  nsTArray<int8_t>* alignmentList = FindCellProperty(this, RowAlignProperty());
+
+  if (alignmentList) {
+    int32_t rowIndex;
+    GetRowIndex(rowIndex);
+
+    // If the row number is greater than the number of provided rowalign values,
+    // we simply repeat the last value.
+    if (rowIndex < (int32_t)alignmentList->Length())
+      alignment = alignmentList->ElementAt(rowIndex);
+    else
+      alignment = alignmentList->ElementAt(alignmentList->Length() - 1);
+  }
+
+  return alignment;
+}
+
+nsresult
+nsMathMLmtdFrame::ProcessBorders(nsTableFrame* aFrame,
+                                 nsDisplayListBuilder* aBuilder,
+                                 const nsDisplayListSet& aLists)
+{
+  aLists.BorderBackground()->AppendNewToTop(new (aBuilder)
+                                            nsDisplaymtdBorder(aBuilder, this));
+  return NS_OK;
+}
 // --------
 // implementation of nsMathMLmtdInnerFrame
 
@@ -845,8 +902,16 @@ NS_NewMathMLmtdInnerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 
 NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtdInnerFrame)
 
+nsMathMLmtdInnerFrame::nsMathMLmtdInnerFrame(nsStyleContext* aContext)
+  : nsBlockFrame(aContext)
+{
+  // Make a copy of the parent nsStyleText for later modificaiton.
+  mUniqueStyleText = new (PresContext()) nsStyleText(*StyleText());
+}
+
 nsMathMLmtdInnerFrame::~nsMathMLmtdInnerFrame()
 {
+  mUniqueStyleText->Destroy(PresContext());
 }
 
 NS_IMETHODIMP
@@ -862,3 +927,37 @@ nsMathMLmtdInnerFrame::Reflow(nsPresContext*          aPresContext,
   // ...
   return rv;
 }
+
+const
+nsStyleText* nsMathMLmtdInnerFrame::StyleTextForLineLayout()
+{
+  // Set the default alignment in case nothing was specified
+  uint8_t alignment = StyleText()->mTextAlign;
+
+  nsTArray<int8_t>* alignmentList =
+    FindCellProperty(this, ColumnAlignProperty());
+
+  if (alignmentList) {
+    nsMathMLmtdFrame* cellFrame = (nsMathMLmtdFrame*)GetParent();
+    int32_t columnIndex;
+    cellFrame->GetColIndex(columnIndex);
+
+    // If the column number is greater than the number of provided columalign
+    // values, we simply repeat the last value.
+    if (columnIndex < (int32_t)alignmentList->Length())
+      alignment = alignmentList->ElementAt(columnIndex);
+    else
+      alignment = alignmentList->ElementAt(alignmentList->Length() - 1);
+  }
+
+  mUniqueStyleText->mTextAlign = alignment;
+  return mUniqueStyleText;
+}
+
+/* virtual */ void
+nsMathMLmtdInnerFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
+{
+  nsBlockFrame::DidSetStyleContext(aOldStyleContext);
+  mUniqueStyleText->Destroy(PresContext());
+  mUniqueStyleText = new (PresContext()) nsStyleText(*StyleText());
+}
diff --git a/layout/mathml/nsMathMLmtableFrame.h b/layout/mathml/nsMathMLmtableFrame.h
index 45e4e54ccfaf..2f7e4d79d077 100644
--- a/layout/mathml/nsMathMLmtableFrame.h
+++ b/layout/mathml/nsMathMLmtableFrame.h
@@ -209,6 +209,11 @@ public:
                    nsIAtom* aAttribute,
                    int32_t  aModType) MOZ_OVERRIDE;
 
+  virtual uint8_t GetVerticalAlign() const;
+  virtual nsresult ProcessBorders(nsTableFrame* aFrame,
+                                  nsDisplayListBuilder* aBuilder,
+                                  const nsDisplayListSet& aLists);
+
   virtual int32_t GetRowSpan() MOZ_OVERRIDE;
   virtual int32_t GetColSpan() MOZ_OVERRIDE;
   virtual bool IsFrameOfType(uint32_t aFlags) const MOZ_OVERRIDE
@@ -256,9 +261,15 @@ public:
       ~(nsIFrame::eMathML | nsIFrame::eExcludesIgnorableWhitespace));
   }
 
+  virtual const nsStyleText* StyleTextForLineLayout();
+  virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext) MOZ_OVERRIDE;
+
 protected:
-  nsMathMLmtdInnerFrame(nsStyleContext* aContext) : nsBlockFrame(aContext) {}
+  nsMathMLmtdInnerFrame(nsStyleContext* aContext);
   virtual ~nsMathMLmtdInnerFrame();
+
+  nsStyleText* mUniqueStyleText;
+
 };  // class nsMathMLmtdInnerFrame
 
 #endif /* nsMathMLmtableFrame_h___ */
diff --git a/layout/tables/nsTableCellFrame.cpp b/layout/tables/nsTableCellFrame.cpp
index 7be95b708345..f974e7ddd423 100644
--- a/layout/tables/nsTableCellFrame.cpp
+++ b/layout/tables/nsTableCellFrame.cpp
@@ -353,6 +353,24 @@ nsTableCellFrame::PaintCellBackground(nsRenderingContext& aRenderingContext,
   PaintBackground(aRenderingContext, aDirtyRect, aPt, aFlags);
 }
 
+nsresult
+nsTableCellFrame::ProcessBorders(nsTableFrame* aFrame,
+                                 nsDisplayListBuilder* aBuilder,
+                                 const nsDisplayListSet& aLists)
+{
+  const nsStyleBorder* borderStyle = StyleBorder();
+  if (aFrame->IsBorderCollapse() || !borderStyle->HasBorder())
+    return NS_OK;
+
+  if (!GetContentEmpty() ||
+      StyleTableBorder()->mEmptyCells == NS_STYLE_TABLE_EMPTY_CELLS_SHOW) {
+    aLists.BorderBackground()->AppendNewToTop(new (aBuilder)
+                                              nsDisplayBorder(aBuilder, this));
+  }
+
+  return NS_OK;
+}
+
 class nsDisplayTableCellBackground : public nsDisplayTableItem {
 public:
   nsDisplayTableCellBackground(nsDisplayListBuilder* aBuilder,
@@ -486,11 +504,7 @@ nsTableCellFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
       }
     
       // display borders if we need to
-      if (!tableFrame->IsBorderCollapse() && borderStyle->HasBorder() &&
-          emptyCellStyle == NS_STYLE_TABLE_EMPTY_CELLS_SHOW) {
-        aLists.BorderBackground()->AppendNewToTop(new (aBuilder)
-          nsDisplayBorder(aBuilder, this));
-      }
+      ProcessBorders(tableFrame, aBuilder, aLists);
     
       // and display the selection border if we need to
       if (IsSelected()) {
diff --git a/layout/tables/nsTableCellFrame.h b/layout/tables/nsTableCellFrame.h
index c3523c5cae9e..9c5c9fd93820 100644
--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@@ -101,6 +101,11 @@ public:
                            const nsRect& aDirtyRect, nsPoint aPt,
                            uint32_t aFlags);
 
+ 
+  virtual nsresult ProcessBorders(nsTableFrame* aFrame,
+                                  nsDisplayListBuilder* aBuilder,
+                                  const nsDisplayListSet& aLists);
+
   virtual nscoord GetMinWidth(nsRenderingContext *aRenderingContext) MOZ_OVERRIDE;
   virtual nscoord GetPrefWidth(nsRenderingContext *aRenderingContext) MOZ_OVERRIDE;
   virtual IntrinsicWidthOffsetData
@@ -129,7 +134,7 @@ public:
    * table cell, which means the result is always
    * NS_STYLE_VERTICAL_ALIGN_{TOP,MIDDLE,BOTTOM,BASELINE}.
    */
-  uint8_t GetVerticalAlign() const;
+  virtual uint8_t GetVerticalAlign() const;
 
   bool HasVerticalAlignBaseline() const {
     return GetVerticalAlign() == NS_STYLE_VERTICAL_ALIGN_BASELINE;

From 7e48d344d0da8afedcf466ce2852c9d6a35054da Mon Sep 17 00:00:00 2001
From: Quentin Headen <qheaden@phaseshiftsoftware.com>
Date: Fri, 13 Dec 2013 12:42:57 -0500
Subject: [PATCH 130/144] Bug 731667 - Rewrite mtable implementation to avoid
 use of _moz-* attributes - remove legacy code. r=karlt

---
 content/base/src/nsGkAtomList.h |  7 ----
 layout/mathml/mathml.css        | 73 ---------------------------------
 2 files changed, 80 deletions(-)

diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 887e914e2933..a5b346cd1bf7 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -1471,13 +1471,6 @@ GK_ATOM(restart, "restart")
 GK_ATOM(to, "to")
 GK_ATOM(XML, "XML")
 
-// internal MathML attributes: different from columnalign_, columnlines_,
-// rowalign_ and rowlines_
-GK_ATOM(_moz_math_columnalign_, "_moz-math-columnalign")
-GK_ATOM(_moz_math_columnline_, "_moz-math-columnline")
-GK_ATOM(_moz_math_rowalign_, "_moz-math-rowalign")
-GK_ATOM(_moz_math_rowline_, "_moz-math-rowline")
-
 GK_ATOM(abs_, "abs")
 GK_ATOM(accent_, "accent")
 GK_ATOM(accentunder_, "accentunder")
diff --git a/layout/mathml/mathml.css b/layout/mathml/mathml.css
index 83ee9f462fb7..ae8abf231b2e 100644
--- a/layout/mathml/mathml.css
+++ b/layout/mathml/mathml.css
@@ -143,53 +143,6 @@ mlabeledtr > mtd:first-child {
     display: none;
 }
 
-/***********************/
-/* -- mtd: columnalign */
-
-mtd[_moz-math-columnalign="left"],
-mtd[columnalign="left"] {
-  text-align: left;
-}
-mtd[_moz-math-columnalign="right"],
-mtd[columnalign="right"] {
-  text-align: right;
-}
-mtd[_moz-math-columnalign="center"],
-mtd[columnalign="center"] {
-  text-align: -moz-center;
-}
-
-/*************************/
-/* -- mtr, mtd: rowalign */
-
-mtr[_moz-math-rowalign="top"],
-mtr[rowalign="top"],
-mtd[rowalign="top"] {
-  vertical-align: top;
-}
-mtr[_moz-math-rowalign="bottom"],
-mtr[rowalign="bottom"],
-mtd[rowalign="bottom"] {
-  vertical-align: bottom;
-}
-mtr[_moz-math-rowalign="center"],
-mtr[rowalign="center"],
-mtd[rowalign="center"] {
-  vertical-align: middle;
-}
-mtr[_moz-math-rowalign="baseline"],
-mtr[rowalign="baseline"],
-mtd[rowalign="baseline"] {
-  vertical-align: baseline;
-}
-/* -- not yet supported --
-mtr[_moz-math-rowalign="axis"],
-mtr[rowalign="axis"],
-mtd[rowalign="axis"] {
-  vertical-align: mathline;
-}
-*/
-
 /**********************************************************************/
 /* rules to achieve the default spacing between cells. The back-end code
    will set the internal attributes depending on the cell's position.
@@ -233,32 +186,6 @@ mtable[frame="dashed"] > mtr > mtd:last-child {
   padding-right: 0.4em; /* framespacing.right */
 }
 
-/**********************************************************************/
-/* internal settings to support 'rowlines' and 'columnlines'. To
-   achieve the recommended behavior, the back-end code will avoid setting
-   unsuitable rules on the cells on the first row and the first column.
-   In general, however, authors can use the 'border' property of CSS to
-   achieve varying effects down to the level of the table cell. */
-mtr[_moz-math-rowline="none"] > mtd {
-  border-top: none;
-}
-mtr[_moz-math-rowline="solid"] > mtd {
-  border-top: solid thin;
-}
-mtr[_moz-math-rowline="dashed"] > mtd {
-  border-top: dashed thin;
-}
-mtd[_moz-math-columnline="none"] {
-  border-left: none;
-}
-mtd[_moz-math-columnline="solid"] {
-  border-left: solid thin;
-}
-mtd[_moz-math-columnline="dashed"] {
-  border-left: dashed thin;
-}
-
-
 /**************************************************************************/
 /* Style used for stretchy symbols *must* be normal to avoid misaligments */
 /* By leaving the font-family empty, the MathML engine will use the value

From 3a7159dca8019add5577671a9d22d6ef59436e09 Mon Sep 17 00:00:00 2001
From: Quentin Headen <qheaden@phaseshiftsoftware.com>
Date: Fri, 13 Dec 2013 12:43:17 -0500
Subject: [PATCH 131/144] Bug 731667 - Rewrite mtable implementation to avoid
 use of _moz-* attributes - tests. r=fredw

---
 ...able-columnalign-multi-mtable-dynamic.html | 146 +++++++++++++++++
 .../mtable-columnalign-multi-mtable.html      | 128 +++++++++++++++
 .../mtable-columnalign-multi-mtr-dynamic.html | 155 ++++++++++++++++++
 .../mathml/mtable-columnalign-multi-mtr.html  | 128 +++++++++++++++
 .../mathml/mtable-columnalign-multi-ref.html  | 128 +++++++++++++++
 ...ble-columnalign-single-mtable-dynamic.html | 146 +++++++++++++++++
 .../mtable-columnalign-single-mtable.html     | 128 +++++++++++++++
 ...mtable-columnalign-single-mtr-dynamic.html | 155 ++++++++++++++++++
 .../mathml/mtable-columnalign-single-mtr.html | 128 +++++++++++++++
 .../mathml/mtable-columnalign-single-ref.html | 128 +++++++++++++++
 ...able-columnlines-multi-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-columnlines-multi-ref.html  |  90 ++++++++++
 ...ble-columnlines-single-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-columnlines-single-ref.html |  90 ++++++++++
 .../mtable-rowalign-multi-mtable-dynamic.html | 146 +++++++++++++++++
 .../mathml/mtable-rowalign-multi-mtable.html  | 128 +++++++++++++++
 .../mathml/mtable-rowalign-multi-ref.html     | 128 +++++++++++++++
 ...mtable-rowalign-single-mtable-dynamic.html | 146 +++++++++++++++++
 .../mathml/mtable-rowalign-single-mtable.html | 128 +++++++++++++++
 .../mtable-rowalign-single-mtr-dynamic.html   | 155 ++++++++++++++++++
 .../mathml/mtable-rowalign-single-mtr.html    | 128 +++++++++++++++
 .../mathml/mtable-rowalign-single-ref.html    | 128 +++++++++++++++
 .../mtable-rowlines-multi-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-rowlines-multi-ref.html     |  90 ++++++++++
 ...mtable-rowlines-single-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-rowlines-single-ref.html    |  90 ++++++++++
 layout/reftests/mathml/reftest.list           |  18 ++
 27 files changed, 3255 insertions(+)
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtr.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtr.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-ref.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-single-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-multi-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtr.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-single-ref.html

diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..20974a55f313
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("columnalign", "left center right");
+        // Table 2 setup
+        table2.setAttribute("columnalign", "right left center");
+        // Table 3 setup
+        table3.setAttribute("columnalign", "center right left");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtable.html b/layout/reftests/mathml/mtable-columnalign-multi-mtable.html
new file mode 100644
index 000000000000..e74ea9e3c58c
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="left center right">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="right left center">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="center right left">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html b/layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html
new file mode 100644
index 000000000000..0d6b65af774f
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html
@@ -0,0 +1,155 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+        var rows = undefined;
+
+        // Table 1 setup
+        rows = table1.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "left center right");
+
+        // Table 2 setup
+        rows = table2.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "right left center");
+
+        // Table 3 setup
+        rows = table3.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "center right left");
+
+        document.documentElement.removeAttribute("class");
+      }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtr.html b/layout/reftests/mathml/mtable-columnalign-multi-mtr.html
new file mode 100644
index 000000000000..cc4cdc87f2d5
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtr.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="left center right">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left center right">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left center right">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="right left center">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right left center">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right left center">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="center right left">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center right left">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center right left">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-ref.html b/layout/reftests/mathml/mtable-columnalign-multi-ref.html
new file mode 100644
index 000000000000..4ee19aa0808c
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="right">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="center">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html
new file mode 100644
index 000000000000..d01f7a5014cc
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("columnalign", "left");
+        // Table 2 setup
+        table2.setAttribute("columnalign", "center");
+        // Table 3 setup
+        table3.setAttribute("columnalign", "right");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtable.html b/layout/reftests/mathml/mtable-columnalign-single-mtable.html
new file mode 100644
index 000000000000..a3ebec777684
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="left">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="center">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="right">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html b/layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html
new file mode 100644
index 000000000000..11112dfa0276
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html
@@ -0,0 +1,155 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+        var rows = undefined;
+
+        // Table 1 setup
+        rows = table1.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "left");
+
+        // Table 2 setup
+        rows = table2.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "center");
+
+        // Table 3 setup
+        rows = table3.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "right");
+
+        document.documentElement.removeAttribute("class");
+      }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtr.html b/layout/reftests/mathml/mtable-columnalign-single-mtr.html
new file mode 100644
index 000000000000..f8003ed8ee38
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtr.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="left">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="center">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="right">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-ref.html b/layout/reftests/mathml/mtable-columnalign-single-ref.html
new file mode 100644
index 000000000000..fb926b38fbe7
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..643fa6ffc08f
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("columnlines", "solid dashed");
+        // Table 2 setup
+        table2.setAttribute("columnlines", "dashed solid");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>columnlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-multi-ref.html b/layout/reftests/mathml/mtable-columnlines-multi-ref.html
new file mode 100644
index 000000000000..7b10b4e25e37
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-multi-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnlines</title>
+  </head>
+  <body>
+  <b>columnlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="solid dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="dashed solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html
new file mode 100644
index 000000000000..6b77fb8ebee2
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("columnlines", "solid");
+        // Table 2 setup
+        table2.setAttribute("columnlines", "dashed");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>columnlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-single-ref.html b/layout/reftests/mathml/mtable-columnlines-single-ref.html
new file mode 100644
index 000000000000..7a2749156a6c
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-single-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnlines</title>
+  </head>
+  <body>
+  <b>columnlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..9bcfa2f203b1
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("rowalign", "top center bottom");
+        // Table 2 setup
+        table2.setAttribute("rowalign", "bottom top center");
+        // Table 3 setup
+        table3.setAttribute("rowalign", "center bottom top");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>rowalign="top center bottom"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom top center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center bottom top"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-multi-mtable.html b/layout/reftests/mathml/mtable-rowalign-multi-mtable.html
new file mode 100644
index 000000000000..bc3493cf15b4
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-multi-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top center bottom"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable rowalign="top center bottom">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom top center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="bottom top center">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center bottom top"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="center bottom top">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-multi-ref.html b/layout/reftests/mathml/mtable-rowalign-multi-ref.html
new file mode 100644
index 000000000000..a39eab436cf9
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-multi-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top center bottom"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom top center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center bottom top"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html
new file mode 100644
index 000000000000..a147b8e7872b
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("rowalign", "top");
+        // Table 2 setup
+        table2.setAttribute("rowalign", "center");
+        // Table 3 setup
+        table3.setAttribute("rowalign", "bottom");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtable.html b/layout/reftests/mathml/mtable-rowalign-single-mtable.html
new file mode 100644
index 000000000000..efa7ef711e9d
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable rowalign="top">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="center">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="bottom">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html b/layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html
new file mode 100644
index 000000000000..e7152776c88b
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html
@@ -0,0 +1,155 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+        var rows = undefined;
+
+        // Table 1 setup
+        rows = table1.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("rowalign", "top");
+
+        // Table 2 setup
+        rows = table2.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("rowalign", "center");
+
+        // Table 3 setup
+        rows = table3.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("rowalign", "bottom");
+
+        document.documentElement.removeAttribute("class");
+      }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtr.html b/layout/reftests/mathml/mtable-rowalign-single-mtr.html
new file mode 100644
index 000000000000..9057e1115aef
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtr.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr rowalign="top">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="top">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="top">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr rowalign="center">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="center">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="center">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr rowalign="bottom">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="bottom">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="bottom">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-ref.html b/layout/reftests/mathml/mtable-rowalign-single-ref.html
new file mode 100644
index 000000000000..786f5f3e7b69
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..bbf203568cc9
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("rowlines", "solid dashed");
+        // Table 2 setup
+        table2.setAttribute("rowlines", "dashed solid");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>rowlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-multi-ref.html b/layout/reftests/mathml/mtable-rowlines-multi-ref.html
new file mode 100644
index 000000000000..3562ba0c73fe
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-multi-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowlines</title>
+  </head>
+  <body>
+  <b>rowlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="solid dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="dashed solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html
new file mode 100644
index 000000000000..3b5bd3c7c0b3
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("rowlines", "solid");
+        // Table 2 setup
+        table2.setAttribute("rowlines", "dashed");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>rowlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-single-ref.html b/layout/reftests/mathml/mtable-rowlines-single-ref.html
new file mode 100644
index 000000000000..9ffc887eb07e
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-single-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowlines</title>
+  </head>
+  <body>
+  <b>rowlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/reftest.list b/layout/reftests/mathml/reftest.list
index 31cb3f47099e..fd34c60730b7 100644
--- a/layout/reftests/mathml/reftest.list
+++ b/layout/reftests/mathml/reftest.list
@@ -113,6 +113,24 @@ fails == mstyle-5.xhtml mstyle-5-ref.xhtml # Bug 787215
 == positive-namedspace.html positive-namedspace-ref.html
 == mtable-align-whitespace.html mtable-align-whitespace-ref.html
 == mtable-width.html mtable-width-ref.html
+== mtable-rowlines-single-mtable-dynamic.html mtable-rowlines-single-ref.html
+== mtable-rowlines-multi-mtable-dynamic.html mtable-rowlines-multi-ref.html
+== mtable-rowalign-single-mtr.html mtable-rowalign-single-ref.html
+== mtable-rowalign-single-mtr-dynamic.html mtable-rowalign-single-ref.html
+== mtable-rowalign-single-mtable.html mtable-rowalign-single-ref.html
+== mtable-rowalign-single-mtable-dynamic.html mtable-rowalign-single-ref.html
+== mtable-rowalign-multi-mtable.html mtable-rowalign-multi-ref.html
+== mtable-rowalign-multi-mtable-dynamic.html mtable-rowalign-multi-ref.html
+== mtable-columnlines-single-mtable-dynamic.html mtable-columnlines-single-ref.html
+== mtable-columnlines-multi-mtable-dynamic.html mtable-columnlines-multi-ref.html
+== mtable-columnalign-single-mtr.html mtable-columnalign-single-ref.html
+== mtable-columnalign-single-mtr-dynamic.html mtable-columnalign-single-ref.html
+== mtable-columnalign-single-mtable.html mtable-columnalign-single-ref.html
+== mtable-columnalign-single-mtable-dynamic.html mtable-columnalign-single-ref.html
+== mtable-columnalign-multi-mtr.html mtable-columnalign-multi-ref.html
+== mtable-columnalign-multi-mtr-dynamic.html mtable-columnalign-multi-ref.html
+== mtable-columnalign-multi-mtable.html mtable-columnalign-multi-ref.html
+== mtable-columnalign-multi-mtable-dynamic.html mtable-columnalign-multi-ref.html
 == maction-selection.html maction-selection-ref.html
 == maction-dynamic-embellished-op.html maction-dynamic-embellished-op-ref.html
 skip-if(B2G) == maction-dynamic-1.html maction-dynamic-1-ref.html # bug 773482

From 287ef9237aa323ce647b0c8fe8e4994f2038871f Mon Sep 17 00:00:00 2001
From: Morris Tseng <mtseng@mozilla.com>
Date: Fri, 13 Dec 2013 12:45:13 -0500
Subject: [PATCH 132/144] Bug 893304 - Convert CanvasClient to new
 TextureClient/Host. r=nical, r=snorp, r=jgilbert

---
 gfx/layers/client/CanvasClient.cpp     |  82 +++++++++++-
 gfx/layers/client/CanvasClient.h       |  31 +++++
 gfx/layers/client/ClientCanvasLayer.h  |   9 +-
 gfx/layers/opengl/TextureClientOGL.cpp |  37 ++++++
 gfx/layers/opengl/TextureClientOGL.h   |  30 +++++
 gfx/layers/opengl/TextureHostOGL.cpp   | 177 +++++++++++++++++++++++++
 gfx/layers/opengl/TextureHostOGL.h     | 102 ++++++++++++++
 7 files changed, 457 insertions(+), 11 deletions(-)

diff --git a/gfx/layers/client/CanvasClient.cpp b/gfx/layers/client/CanvasClient.cpp
index 26553b3e5b94..f7fa64d619e8 100644
--- a/gfx/layers/client/CanvasClient.cpp
+++ b/gfx/layers/client/CanvasClient.cpp
@@ -17,6 +17,8 @@
 #include "mozilla/layers/CompositableForwarder.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/TextureClient.h"  // for TextureClient, etc
+#include "mozilla/layers/GrallocTextureClient.h"
+#include "mozilla/layers/TextureClientOGL.h"
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsDebug.h"                    // for printf_stderr, NS_ASSERTION
 #include "nsXULAppAPI.h"                // for XRE_GetProcessType, etc
@@ -27,12 +29,6 @@
 using namespace mozilla::gfx;
 using namespace mozilla::gl;
 
-namespace mozilla {
-namespace gfx {
-class SharedSurface;
-}
-}
-
 namespace mozilla {
 namespace layers {
 
@@ -44,7 +40,7 @@ CanvasClient::CreateCanvasClient(CanvasClientType aType,
   if (aType == CanvasClientGLContext &&
       aForwarder->GetCompositorBackendType() == LAYERS_OPENGL) {
     aFlags |= TEXTURE_DEALLOCATE_CLIENT;
-    return new DeprecatedCanvasClientSurfaceStream(aForwarder, aFlags);
+    return new CanvasClientSurfaceStream(aForwarder, aFlags);
   }
   if (gfxPlatform::GetPlatform()->UseDeprecatedTextures()) {
     aFlags |= TEXTURE_DEALLOCATE_CLIENT;
@@ -106,6 +102,78 @@ CanvasClient2D::CreateBufferTextureClient(gfx::SurfaceFormat aFormat, TextureFla
                                                        mTextureInfo.mTextureFlags | aFlags);
 }
 
+CanvasClientSurfaceStream::CanvasClientSurfaceStream(CompositableForwarder* aLayerForwarder,
+                                                     TextureFlags aFlags)
+  : CanvasClient(aLayerForwarder, aFlags)
+{
+}
+
+void
+CanvasClientSurfaceStream::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
+{
+  GLScreenBuffer* screen = aLayer->mGLContext->Screen();
+  SurfaceStream* stream = screen->Stream();
+
+  bool isCrossProcess = !(XRE_GetProcessType() == GeckoProcessType_Default);
+  bool bufferCreated = false;
+  if (isCrossProcess) {
+#ifdef MOZ_WIDGET_GONK
+    SharedSurface* surf = stream->SwapConsumer();
+    if (!surf) {
+      printf_stderr("surf is null post-SwapConsumer!\n");
+      return;
+    }
+
+    if (surf->Type() != SharedSurfaceType::Gralloc) {
+      printf_stderr("Unexpected non-Gralloc SharedSurface in IPC path!");
+      MOZ_ASSERT(false);
+      return;
+    }
+
+    SharedSurface_Gralloc* grallocSurf = SharedSurface_Gralloc::Cast(surf);
+
+    if (mBuffers.find(surf) == mBuffers.end()) {
+      GrallocTextureClientOGL* grallocTC =
+        new GrallocTextureClientOGL(static_cast<GrallocBufferActor*>(grallocSurf->GetDescriptor().bufferChild()),
+                                                                     grallocSurf->Size(),
+                                                                     mTextureInfo.mTextureFlags);
+
+      mBuffers[surf] = grallocTC;
+      bufferCreated = true;
+    }
+
+    if (bufferCreated && !AddTextureClient(mBuffers[surf])) {
+      mBuffers.erase(surf);
+    }
+
+    if (mBuffers.find(surf) != mBuffers.end()) {
+      GetForwarder()->UseTexture(this, mBuffers[surf]);
+    }
+#else
+    printf_stderr("isCrossProcess, but not MOZ_WIDGET_GONK! Someone needs to write some code!");
+    MOZ_ASSERT(false);
+#endif
+  } else {
+    if (!mBuffer) {
+      StreamTextureClientOGL* textureClient =
+        new StreamTextureClientOGL(mTextureInfo.mTextureFlags);
+      textureClient->InitWith(stream);
+      mBuffer = textureClient;
+      bufferCreated = true;
+    }
+
+    if (bufferCreated && !AddTextureClient(mBuffer)) {
+      mBuffer = nullptr;
+    }
+
+    if (mBuffer) {
+      GetForwarder()->UseTexture(this, mBuffer);
+    }
+  }
+
+  aLayer->Painted();
+}
+
 void
 DeprecatedCanvasClient2D::Updated()
 {
diff --git a/gfx/layers/client/CanvasClient.h b/gfx/layers/client/CanvasClient.h
index e0d534b00d34..e537151d038f 100644
--- a/gfx/layers/client/CanvasClient.h
+++ b/gfx/layers/client/CanvasClient.h
@@ -18,6 +18,12 @@
 #include "mozilla/gfx/Point.h"          // for IntSize
 #include "mozilla/gfx/Types.h"          // for SurfaceFormat
 
+namespace mozilla {
+namespace gfx {
+class SharedSurface;
+}
+}
+
 namespace mozilla {
 namespace layers {
 
@@ -95,6 +101,31 @@ private:
   RefPtr<TextureClient> mBuffer;
 };
 
+// Used for GL canvases where we don't need to do any readback, i.e., with a
+// GL backend.
+class CanvasClientSurfaceStream : public CanvasClient
+{
+public:
+  CanvasClientSurfaceStream(CompositableForwarder* aLayerForwarder, TextureFlags aFlags);
+
+  TextureInfo GetTextureInfo() const
+  {
+    return TextureInfo(COMPOSITABLE_IMAGE);
+  }
+
+  virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer) MOZ_OVERRIDE;
+
+  virtual void OnDetach() MOZ_OVERRIDE
+  {
+    mBuffers.clear();
+    mBuffer = nullptr;
+  }
+
+private:
+  std::map<gfx::SharedSurface*, RefPtr<TextureClient> > mBuffers;
+  RefPtr<TextureClient> mBuffer;
+};
+
 class DeprecatedCanvasClient2D : public CanvasClient
 {
 public:
diff --git a/gfx/layers/client/ClientCanvasLayer.h b/gfx/layers/client/ClientCanvasLayer.h
index 6af3f430fd64..c46ac332f558 100644
--- a/gfx/layers/client/ClientCanvasLayer.h
+++ b/gfx/layers/client/ClientCanvasLayer.h
@@ -51,11 +51,11 @@ public:
                  "Can only set properties in construction phase");
     CanvasLayer::SetVisibleRegion(aRegion);
   }
-  
+
   virtual void Initialize(const Data& aData);
 
   virtual void RenderLayer();
-  
+
   virtual void FillSpecificAttributes(SpecificLayerAttributes& aAttrs)
   {
     aAttrs = CanvasLayerAttributes(mFilter, mBounds);
@@ -63,7 +63,7 @@ public:
 
   virtual Layer* AsLayer() { return this; }
   virtual ShadowableLayer* AsShadowableLayer() { return this; }
-  
+
   virtual void Disconnect()
   {
     mCanvasClient = nullptr;
@@ -79,7 +79,7 @@ protected:
   {
     return static_cast<ClientLayerManager*>(mManager);
   }
-  
+
   CanvasClientType GetCanvasClientType()
   {
     if (mGLContext) {
@@ -93,6 +93,7 @@ protected:
   friend class DeprecatedCanvasClient2D;
   friend class CanvasClient2D;
   friend class DeprecatedCanvasClientSurfaceStream;
+  friend class CanvasClientSurfaceStream;
 };
 }
 }
diff --git a/gfx/layers/opengl/TextureClientOGL.cpp b/gfx/layers/opengl/TextureClientOGL.cpp
index e52858850ccc..2632f5d0de94 100644
--- a/gfx/layers/opengl/TextureClientOGL.cpp
+++ b/gfx/layers/opengl/TextureClientOGL.cpp
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/layers/TextureClientOGL.h"
+#include "SurfaceStream.h"
 #include "GLContext.h"                  // for GLContext, etc
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/layers/ISurfaceAllocator.h"
@@ -66,6 +67,42 @@ SharedTextureClientOGL::IsAllocated() const
   return mHandle != 0;
 }
 
+StreamTextureClientOGL::StreamTextureClientOGL(TextureFlags aFlags)
+  : TextureClient(aFlags)
+  , mStream(0)
+{
+}
+
+StreamTextureClientOGL::~StreamTextureClientOGL()
+{
+  // the data is owned externally.
+}
+
+bool
+StreamTextureClientOGL::ToSurfaceDescriptor(SurfaceDescriptor& aOutDescriptor)
+{
+  if (!IsAllocated()) {
+    return false;
+  }
+
+  gfx::SurfaceStreamHandle handle = mStream->GetShareHandle();
+  aOutDescriptor = SurfaceStreamDescriptor(handle, false);
+  return true;
+}
+
+void
+StreamTextureClientOGL::InitWith(gfx::SurfaceStream* aStream)
+{
+  MOZ_ASSERT(!IsAllocated());
+  mStream = aStream;
+}
+
+bool
+StreamTextureClientOGL::IsAllocated() const
+{
+  return mStream != 0;
+}
+
 DeprecatedTextureClientSharedOGL::DeprecatedTextureClientSharedOGL(CompositableForwarder* aForwarder,
                                                const TextureInfo& aTextureInfo)
   : DeprecatedTextureClient(aForwarder, aTextureInfo)
diff --git a/gfx/layers/opengl/TextureClientOGL.h b/gfx/layers/opengl/TextureClientOGL.h
index 6964d100dd3b..6afa130711a3 100644
--- a/gfx/layers/opengl/TextureClientOGL.h
+++ b/gfx/layers/opengl/TextureClientOGL.h
@@ -14,6 +14,12 @@
 #include "mozilla/layers/LayersSurfaces.h"  // for SurfaceDescriptor
 #include "mozilla/layers/TextureClient.h"  // for DeprecatedTextureClient, etc
 
+namespace mozilla {
+namespace gfx {
+class SurfaceStream;
+}
+}
+
 namespace mozilla {
 namespace layers {
 
@@ -57,6 +63,30 @@ protected:
   bool mInverted;
 };
 
+/**
+ * A TextureClient implementation to share SurfaceStream.
+ */
+class StreamTextureClientOGL : public TextureClient
+{
+public:
+  StreamTextureClientOGL(TextureFlags aFlags);
+
+  ~StreamTextureClientOGL();
+
+  virtual bool IsAllocated() const MOZ_OVERRIDE;
+
+  virtual bool ToSurfaceDescriptor(SurfaceDescriptor& aOutDescriptor) MOZ_OVERRIDE;
+
+  virtual TextureClientData* DropTextureData() MOZ_OVERRIDE { return nullptr; }
+
+  void InitWith(gfx::SurfaceStream* aStream);
+
+  virtual gfx::IntSize GetSize() const { return gfx::IntSize(); }
+
+protected:
+  gfx::SurfaceStream* mStream;
+};
+
 class DeprecatedTextureClientSharedOGL : public DeprecatedTextureClient
 {
 public:
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 16be30f5dabe..7207de68d859 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -109,6 +109,11 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc,
                                         desc.inverted());
       break;
     }
+    case SurfaceDescriptor::TSurfaceStreamDescriptor: {
+      const SurfaceStreamDescriptor& desc = aDesc.get_SurfaceStreamDescriptor();
+      result = new StreamTextureHostOGL(aFlags, desc);
+      break;
+    }
 #ifdef XP_MACOSX
     case SurfaceDescriptor::TSurfaceDescriptorMacIOSurface: {
       const SurfaceDescriptorMacIOSurface& desc =
@@ -455,6 +460,178 @@ SharedTextureHostOGL::GetFormat() const
   return mTextureSource->GetFormat();
 }
 
+void
+StreamTextureSourceOGL::BindTexture(GLenum activetex)
+{
+  MOZ_ASSERT(gl());
+  gl()->fActiveTexture(activetex);
+  gl()->fBindTexture(mTextureTarget, mTextureHandle);
+}
+
+bool
+StreamTextureSourceOGL::RetrieveTextureFromStream()
+{
+  gl()->MakeCurrent();
+
+  SharedSurface* sharedSurf = mStream->SwapConsumer();
+  if (!sharedSurf) {
+    // We don't have a valid surf to show yet.
+    return false;
+  }
+
+  gl()->MakeCurrent();
+
+  mSize = IntSize(sharedSurf->Size().width, sharedSurf->Size().height);
+
+  gfxImageSurface* toUpload = nullptr;
+  switch (sharedSurf->Type()) {
+    case SharedSurfaceType::GLTextureShare: {
+      SharedSurface_GLTexture* glTexSurf = SharedSurface_GLTexture::Cast(sharedSurf);
+      glTexSurf->SetConsumerGL(gl());
+      mTextureHandle = glTexSurf->Texture();
+      mTextureTarget = glTexSurf->TextureTarget();
+      MOZ_ASSERT(mTextureHandle);
+      mFormat = sharedSurf->HasAlpha() ? FORMAT_R8G8B8A8
+                                       : FORMAT_R8G8B8X8;
+      break;
+    }
+    case SharedSurfaceType::EGLImageShare: {
+      SharedSurface_EGLImage* eglImageSurf =
+          SharedSurface_EGLImage::Cast(sharedSurf);
+
+      mTextureHandle = eglImageSurf->AcquireConsumerTexture(gl());
+      mTextureTarget = eglImageSurf->TextureTarget();
+      if (!mTextureHandle) {
+        toUpload = eglImageSurf->GetPixels();
+        MOZ_ASSERT(toUpload);
+      } else {
+        mFormat = sharedSurf->HasAlpha() ? FORMAT_R8G8B8A8
+                                         : FORMAT_R8G8B8X8;
+      }
+      break;
+    }
+#ifdef XP_MACOSX
+    case SharedSurfaceType::IOSurface: {
+      SharedSurface_IOSurface* glTexSurf = SharedSurface_IOSurface::Cast(sharedSurf);
+      mTextureHandle = glTexSurf->Texture();
+      mTextureTarget = glTexSurf->TextureTarget();
+      MOZ_ASSERT(mTextureHandle);
+      mFormat = sharedSurf->HasAlpha() ? FORMAT_R8G8B8A8
+                                       : FORMAT_R8G8B8X8;
+      break;
+    }
+#endif
+    case SharedSurfaceType::Basic: {
+      toUpload = SharedSurface_Basic::Cast(sharedSurf)->GetData();
+      MOZ_ASSERT(toUpload);
+      break;
+    }
+    default:
+      MOZ_CRASH("Invalid SharedSurface type.");
+  }
+
+  if (toUpload) {
+    // mBounds seems to end up as (0,0,0,0) a lot, so don't use it?
+    nsIntSize size(toUpload->GetSize());
+    nsIntRect rect(nsIntPoint(0,0), size);
+    nsIntRegion bounds(rect);
+    mFormat = UploadSurfaceToTexture(gl(),
+                                     toUpload,
+                                     bounds,
+                                     mUploadTexture,
+                                     true);
+    mTextureHandle = mUploadTexture;
+    mTextureTarget = LOCAL_GL_TEXTURE_2D;
+  }
+
+  MOZ_ASSERT(mTextureHandle);
+  gl()->fBindTexture(mTextureTarget, mTextureHandle);
+  gl()->fTexParameteri(mTextureTarget,
+                      LOCAL_GL_TEXTURE_WRAP_S,
+                      LOCAL_GL_CLAMP_TO_EDGE);
+  gl()->fTexParameteri(mTextureTarget,
+                      LOCAL_GL_TEXTURE_WRAP_T,
+                      LOCAL_GL_CLAMP_TO_EDGE);
+
+  return true;
+}
+
+void
+StreamTextureSourceOGL::DeallocateDeviceData()
+{
+  if (mUploadTexture) {
+    MOZ_ASSERT(gl());
+    gl()->MakeCurrent();
+    gl()->fDeleteTextures(1, &mUploadTexture);
+    mUploadTexture = 0;
+    mTextureHandle = 0;
+  }
+}
+
+gl::GLContext*
+StreamTextureSourceOGL::gl() const
+{
+  return mCompositor ? mCompositor->gl() : nullptr;
+}
+
+StreamTextureHostOGL::StreamTextureHostOGL(TextureFlags aFlags,
+                                           const SurfaceStreamDescriptor& aDesc)
+  : TextureHost(aFlags)
+{
+  mStream = SurfaceStream::FromHandle(aDesc.handle());
+  MOZ_ASSERT(mStream);
+}
+
+StreamTextureHostOGL::~StreamTextureHostOGL()
+{
+  // If need to deallocate textures, call DeallocateSharedData() before
+  // the destructor
+}
+
+bool
+StreamTextureHostOGL::Lock()
+{
+  if (!mCompositor) {
+    return false;
+  }
+
+  if (!mTextureSource) {
+    mTextureSource = new StreamTextureSourceOGL(mCompositor,
+                                                mStream);
+  }
+
+  return mTextureSource->RetrieveTextureFromStream();
+}
+
+void
+StreamTextureHostOGL::Unlock()
+{
+}
+
+void
+StreamTextureHostOGL::SetCompositor(Compositor* aCompositor)
+{
+  CompositorOGL* glCompositor = static_cast<CompositorOGL*>(aCompositor);
+  mCompositor = glCompositor;
+  if (mTextureSource) {
+    mTextureSource->SetCompositor(glCompositor);
+  }
+}
+
+gfx::SurfaceFormat
+StreamTextureHostOGL::GetFormat() const
+{
+  MOZ_ASSERT(mTextureSource);
+  return mTextureSource->GetFormat();
+}
+
+gfx::IntSize
+StreamTextureHostOGL::GetSize() const
+{
+  MOZ_ASSERT(mTextureSource);
+  return mTextureSource->GetSize();
+}
+
 TextureImageDeprecatedTextureHostOGL::~TextureImageDeprecatedTextureHostOGL()
 {
   MOZ_COUNT_DTOR(TextureImageDeprecatedTextureHostOGL);
diff --git a/gfx/layers/opengl/TextureHostOGL.h b/gfx/layers/opengl/TextureHostOGL.h
index 23743453edb2..22f3e6468ee1 100644
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -333,6 +333,108 @@ protected:
   RefPtr<SharedTextureSourceOGL> mTextureSource;
 };
 
+/**
+ * A texture source meant for use with StreamTextureHostOGL.
+ *
+ * It does not own any texture, we get texture from SurfaceStream.
+ */
+class StreamTextureSourceOGL : public NewTextureSource
+                             , public TextureSourceOGL
+{
+public:
+  StreamTextureSourceOGL(CompositorOGL* aCompositor,
+                         gfx::SurfaceStream* aStream)
+    : mCompositor(aCompositor)
+    , mStream(aStream)
+    , mTextureHandle(0)
+    , mTextureTarget(LOCAL_GL_TEXTURE_2D)
+    , mUploadTexture(0)
+    , mFormat(gfx::FORMAT_UNKNOWN)
+  {
+    MOZ_COUNT_CTOR(StreamTextureSourceOGL);
+  }
+
+  ~StreamTextureSourceOGL()
+  {
+    MOZ_COUNT_DTOR(StreamTextureSourceOGL);
+  }
+
+  virtual TextureSourceOGL* AsSourceOGL() { return this; }
+
+  virtual void BindTexture(GLenum activetex) MOZ_OVERRIDE;
+
+  virtual bool IsValid() const MOZ_OVERRIDE { return !!gl(); }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
+
+  virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
+
+  virtual GLenum GetTextureTarget() const { return mTextureTarget; }
+
+  virtual GLenum GetWrapMode() const MOZ_OVERRIDE { return LOCAL_GL_CLAMP_TO_EDGE; }
+
+  virtual void DeallocateDeviceData();
+
+  bool RetrieveTextureFromStream();
+
+  void SetCompositor(CompositorOGL* aCompositor) { mCompositor = aCompositor; }
+
+protected:
+  gl::GLContext* gl() const;
+
+  CompositorOGL* mCompositor;
+  gfx::SurfaceStream* mStream;
+  GLuint mTextureHandle;
+  GLenum mTextureTarget;
+  GLuint mUploadTexture;
+  gfx::IntSize mSize;
+  gfx::SurfaceFormat mFormat;
+};
+
+/**
+ * A TextureHost for shared SurfaceStream
+ */
+class StreamTextureHostOGL : public TextureHost
+{
+public:
+  StreamTextureHostOGL(TextureFlags aFlags,
+                       const SurfaceStreamDescriptor& aDesc);
+
+  virtual ~StreamTextureHostOGL();
+
+  // SharedTextureHostOGL doesn't own any GL texture
+  virtual void DeallocateDeviceData() MOZ_OVERRIDE {}
+
+  virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
+
+  virtual bool Lock() MOZ_OVERRIDE;
+
+  virtual void Unlock() MOZ_OVERRIDE;
+
+  virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
+
+  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  {
+    return mTextureSource;
+  }
+
+  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
+  {
+    return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
+  }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
+
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() { return "StreamTextureHostOGL"; }
+#endif
+
+protected:
+  CompositorOGL* mCompositor;
+  gfx::SurfaceStream* mStream;
+  RefPtr<StreamTextureSourceOGL> mTextureSource;
+};
+
 /**
  * DeprecatedTextureHost implementation using a TextureImage as the underlying texture.
  */

From 97793677212c48c5199537c124b106dc44633550 Mon Sep 17 00:00:00 2001
From: John Shih <jshih@mozilla.com>
Date: Fri, 13 Dec 2013 16:33:46 +0800
Subject: [PATCH 133/144] Bug 940740 - Make sure do_GetService called in
 mainthread. r=mcmanus

---
 .../protocol/websocket/WebSocketChannel.cpp   | 71 ++++++++++++++++---
 netwerk/protocol/websocket/WebSocketChannel.h |  3 +-
 2 files changed, 63 insertions(+), 11 deletions(-)

diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index 7643dcabaca8..b1f2a9c34a0b 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -1083,7 +1083,10 @@ WebSocketChannel::BeginOpen()
 
 #ifdef MOZ_WIDGET_GONK
   if (mAppId != NECKO_NO_APP_ID) {
-    NS_GetActiveNetworkInterface(mActiveNetwork);
+    nsCOMPtr<nsINetworkInterface> activeNetwork;
+    NS_GetActiveNetworkInterface(activeNetwork);
+    mActiveNetwork =
+      new nsMainThreadPtrHolder<nsINetworkInterface>(activeNetwork);
   }
 #endif
 
@@ -3263,6 +3266,57 @@ WebSocketChannel::OnDataAvailable(nsIRequest *aRequest,
   return NS_OK;
 }
 
+//-----------------------------------------------------------------------------
+// WebSocketChannel save network statistics event
+//-----------------------------------------------------------------------------
+
+#ifdef MOZ_WIDGET_GONK
+namespace {
+class SaveNetworkStatsEvent : public nsRunnable {
+public:
+    SaveNetworkStatsEvent(uint32_t aAppId,
+                          nsMainThreadPtrHandle<nsINetworkInterface> &aActiveNetwork,
+                          uint64_t aCountRecv,
+                          uint64_t aCountSent)
+        : mAppId(aAppId),
+          mActiveNetwork(aActiveNetwork),
+          mCountRecv(aCountRecv),
+          mCountSent(aCountSent)
+    {
+        MOZ_ASSERT(mAppId != NECKO_NO_APP_ID);
+        MOZ_ASSERT(mActiveNetwork);
+    }
+
+    NS_IMETHOD Run()
+    {
+        MOZ_ASSERT(NS_IsMainThread());
+
+        nsresult rv;
+        nsCOMPtr<nsINetworkStatsServiceProxy> mNetworkStatsServiceProxy =
+            do_GetService("@mozilla.org/networkstatsServiceProxy;1", &rv);
+        if (NS_FAILED(rv)) {
+            return rv;
+        }
+
+        // save the network stats through NetworkStatsServiceProxy
+        mNetworkStatsServiceProxy->SaveAppStats(mAppId,
+                                                mActiveNetwork,
+                                                PR_Now() / 1000,
+                                                mCountRecv,
+                                                mCountSent,
+                                                nullptr);
+
+        return NS_OK;
+    }
+private:
+    uint32_t mAppId;
+    nsMainThreadPtrHandle<nsINetworkInterface> mActiveNetwork;
+    uint64_t mCountRecv;
+    uint64_t mCountSent;
+};
+};
+#endif
+
 nsresult
 WebSocketChannel::SaveNetworkStats(bool enforce)
 {
@@ -3285,15 +3339,12 @@ WebSocketChannel::SaveNetworkStats(bool enforce)
     return NS_OK;
   }
 
-  nsresult rv;
-  nsCOMPtr<nsINetworkStatsServiceProxy> mNetworkStatsServiceProxy =
-    do_GetService("@mozilla.org/networkstatsServiceProxy;1", &rv);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  mNetworkStatsServiceProxy->SaveAppStats(mAppId, mActiveNetwork, PR_Now() / 1000,
-                                          mCountRecv, mCountSent, nullptr);
+  // Create the event to save the network statistics.
+  // the event is then dispathed to the main thread.
+  nsRefPtr<nsRunnable> event =
+    new SaveNetworkStatsEvent(mAppId, mActiveNetwork,
+                              mCountRecv, mCountSent);
+  NS_DispatchToMainThread(event);
 
   // Reset the counters after saving.
   mCountSent = 0;
diff --git a/netwerk/protocol/websocket/WebSocketChannel.h b/netwerk/protocol/websocket/WebSocketChannel.h
index 32fcda146da4..cc987045b140 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.h
+++ b/netwerk/protocol/websocket/WebSocketChannel.h
@@ -20,6 +20,7 @@
 
 #ifdef MOZ_WIDGET_GONK
 #include "nsINetworkManager.h"
+#include "nsProxyRelease.h" // for nsMainThreadPtrHandle
 #endif
 
 #include "nsCOMPtr.h"
@@ -261,7 +262,7 @@ private:
   uint64_t                        mCountSent;
   uint32_t                        mAppId;
 #ifdef MOZ_WIDGET_GONK
-  nsCOMPtr<nsINetworkInterface>   mActiveNetwork;
+  nsMainThreadPtrHandle<nsINetworkInterface> mActiveNetwork;
 #endif
   nsresult                        SaveNetworkStats(bool);
   void                            CountRecvBytes(uint64_t recvBytes)

From df7395ce5d555b54708496ae494cbf1de88a60de Mon Sep 17 00:00:00 2001
From: Douglas Crosher <dtc-moz@scieneer.com>
Date: Fri, 13 Dec 2013 15:27:13 +1100
Subject: [PATCH 134/144] Bug 949742 - Ionmonkey: Improve the register
 allocation for Float32ToDouble. r=benj

---
 js/src/jit/Lowering.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 5f0b099ba712..67d8af974949 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1683,7 +1683,7 @@ LIRGenerator::visitToDouble(MToDouble *convert)
 
       case MIRType_Float32:
       {
-        LFloat32ToDouble *lir = new(alloc()) LFloat32ToDouble(useRegister(opd));
+        LFloat32ToDouble *lir = new(alloc()) LFloat32ToDouble(useRegisterAtStart(opd));
         return define(lir, convert);
       }
 

From 20a6dcc6075f3b04b145024660f1cac1b56d3af9 Mon Sep 17 00:00:00 2001
From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
Date: Thu, 12 Dec 2013 16:30:59 -0800
Subject: [PATCH 135/144] Bug 949749 - Fix up include guard in SyncRunnable.h.
 r=froydnj

---
 xpcom/threads/SyncRunnable.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xpcom/threads/SyncRunnable.h b/xpcom/threads/SyncRunnable.h
index ebd560c3ca86..60ce8e9e2469 100644
--- a/xpcom/threads/SyncRunnable.h
+++ b/xpcom/threads/SyncRunnable.h
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_SyncRunnable_h
+#define mozilla_SyncRunnable_h
 
 #include "nsThreadUtils.h"
 #include "mozilla/Monitor.h"

From 0aa5a840faf21c35257e31d05ddf5f94d87da345 Mon Sep 17 00:00:00 2001
From: "Szu-Yu Chen [:aknow]" <szchen@mozilla.com>
Date: Fri, 13 Dec 2013 11:46:23 -0500
Subject: [PATCH 136/144] Bug 949876 - Fix setRadioEnabled queueing method.
 r=hsinyi

---
 dom/system/gonk/RadioInterfaceLayer.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index 94c36dbc29e4..c6b85204d1a0 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -491,7 +491,7 @@ XPCOMUtils.defineLazyGetter(this, "gRadioEnabledController", function () {
     receiveMessage: function(msg) {
       if (DEBUG) debug("setRadioEnabled: receiveMessage: " + JSON.stringify(msg));
       this.pendingMessages.push(msg);
-      if (this.pendingMessages.length === 1) {
+      if (this.pendingMessages.length === 1 && !this.isDeactivatingDataCalls()) {
         this._processNextMessage();
       }
     },
@@ -540,7 +540,6 @@ XPCOMUtils.defineLazyGetter(this, "gRadioEnabledController", function () {
       } else {
         this.request = (function() {
           radioInterface.receiveMessage(msg);
-          this._processNextMessage();
         }).bind(this);
 
         // In some DSDS architecture with only one modem, toggling one radio may
@@ -596,6 +595,7 @@ XPCOMUtils.defineLazyGetter(this, "gRadioEnabledController", function () {
         this.request();
         this.request = null;
       }
+      this._processNextMessage();
     }
   };
 });

From 0fd36d97ed20c8c38945a768498197a08af5cd4a Mon Sep 17 00:00:00 2001
From: Vivien Nicolas <21@vingtetun.org>
Date: Fri, 13 Dec 2013 18:23:47 +0100
Subject: [PATCH 137/144] Bug 949404 - Applications are half repainted once the
 keyboard is closed. r=Cwiiis

---
 gfx/layers/FrameMetrics.h                 | 24 +++++++++++++++++++++++
 gfx/layers/ipc/AsyncPanZoomController.cpp | 19 +-----------------
 widget/xpwidgets/APZCCallbackHelper.cpp   |  4 ++--
 3 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/gfx/layers/FrameMetrics.h b/gfx/layers/FrameMetrics.h
index c5d538ad984e..51d442070124 100644
--- a/gfx/layers/FrameMetrics.h
+++ b/gfx/layers/FrameMetrics.h
@@ -113,6 +113,30 @@ public:
     return mCumulativeResolution / mResolution;
   }
 
+  // Ensure the scrollableRect is at least as big as the compositionBounds
+  // because the scrollableRect can be smaller if the content is not large
+  // and the scrollableRect hasn't been updated yet.
+  // We move the scrollableRect up because we don't know if we can move it
+  // down. i.e. we know that scrollableRect can go back as far as zero.
+  // but we don't know how much further ahead it can go.
+  CSSRect GetExpandedScrollableRect() const
+  {
+    CSSRect scrollableRect = mScrollableRect;
+    if (scrollableRect.width < mCompositionBounds.width) {
+      scrollableRect.x = std::max(0.f,
+                                  scrollableRect.x - (mCompositionBounds.width - scrollableRect.width));
+      scrollableRect.width = mCompositionBounds.width;
+    }
+
+    if (scrollableRect.height < mCompositionBounds.height) {
+      scrollableRect.y = std::max(0.f,
+                                  scrollableRect.y - (mCompositionBounds.height - scrollableRect.height));
+      scrollableRect.height = mCompositionBounds.height;
+    }
+
+    return scrollableRect;
+  }
+
   /**
    * Return the scale factor needed to fit the viewport
    * into its composition bounds.
diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index a1a034ffa564..b02e71263980 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -1165,25 +1165,8 @@ const CSSRect AsyncPanZoomController::CalculatePendingDisplayPort(
     aEstimatedPaintDuration > EPSILON ? aEstimatedPaintDuration : 1.0;
 
   CSSIntRect compositionBounds = gfx::RoundedIn(aFrameMetrics.mCompositionBounds / aFrameMetrics.mZoom);
-  CSSRect scrollableRect = aFrameMetrics.mScrollableRect;
-
-  // Ensure the scrollableRect is at least as big as the compositionBounds
-  // because the scrollableRect can be smaller if the content is not large
-  // and the scrollableRect hasn't been updated yet.
-  // We move the scrollableRect up because we don't know if we can move it
-  // down. i.e. we know that scrollableRect can go back as far as zero.
-  // but we don't know how much further ahead it can go.
-  if (scrollableRect.width < compositionBounds.width) {
-      scrollableRect.x = std::max(0.f,
-                                  scrollableRect.x - (compositionBounds.width - scrollableRect.width));
-      scrollableRect.width = compositionBounds.width;
-  }
-  if (scrollableRect.height < compositionBounds.height) {
-      scrollableRect.y = std::max(0.f,
-                                  scrollableRect.y - (compositionBounds.height - scrollableRect.height));
-      scrollableRect.height = compositionBounds.height;
-  }
 
+  CSSRect scrollableRect = aFrameMetrics.GetExpandedScrollableRect();
   CSSPoint scrollOffset = aFrameMetrics.mScrollOffset;
 
   CSSRect displayPort = CSSRect(compositionBounds);
diff --git a/widget/xpwidgets/APZCCallbackHelper.cpp b/widget/xpwidgets/APZCCallbackHelper.cpp
index 79429d542c69..3ea68570101c 100644
--- a/widget/xpwidgets/APZCCallbackHelper.cpp
+++ b/widget/xpwidgets/APZCCallbackHelper.cpp
@@ -78,8 +78,8 @@ MaybeAlignAndClampDisplayPort(mozilla::layers::FrameMetrics& aFrameMetrics,
       - aActualScrollOffset;
   }
 
-  // Finally, clamp the display port to the scrollable rect.
-  CSSRect scrollableRect = aFrameMetrics.mScrollableRect;
+  // Finally, clamp the display port to the expanded scrollable rect.
+  CSSRect scrollableRect = aFrameMetrics.GetExpandedScrollableRect();
   displayPort = scrollableRect.Intersect(displayPort + aActualScrollOffset)
     - aActualScrollOffset;
 }

From fce8b5cad9ae8bf4e51a62f1b2d75e495134d866 Mon Sep 17 00:00:00 2001
From: Vivien Nicolas <21@vingtetun.org>
Date: Fri, 13 Dec 2013 18:23:49 +0100
Subject: [PATCH 138/144] Bug 943849 - [Shared] Fixed headers does not follow
 correctly the rendered view. r=kats

---
 b2g/app/b2g.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 817da4813953..fda271b9cae4 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -856,3 +856,9 @@ pref("osfile.reset_worker_delay", 5000);
 
 // The URL of the Firefox Accounts auth server backend
 pref("identity.fxaccounts.auth.uri", "https://api-accounts.dev.lcip.org/v1");
+
+// APZC preferences.
+//
+// Gaia relies heavily on scroll events for now, so lets fire them
+// more often than the default value (100).
+pref("apz.asyncscroll.throttle", 40);

From a8afdb948a62d728eb6968aa680c66edcfc4e153 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 09:30:25 -0800
Subject: [PATCH 139/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/2b63513acfbf
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Merge pull request #14649 from fcampo/sms-overlay-style-broken-947285

Bug 947285 - [Messaging] Notice style is broken (r=julienw)

========

https://hg.mozilla.org/integration/gaia-central/rev/a6211c58e5cf
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Bug 947285 - [Messaging] Notice style is broken
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 1929ed741554..2ef805efe0f0 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "aed25a1b6915f94d81f766c51d71df557019ae3e", 
+    "revision": "2b63513acfbf8b2c8e55465cb209c2ace9db05b0", 
     "repo_path": "/integration/gaia-central"
 }

From 47faef9328044a0c7376711ec7f1198c5ca1ab2b Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Fri, 13 Dec 2013 12:46:59 -0500
Subject: [PATCH 140/144] Bug 949932 - Null-check the new StickyScrollContainer
 in case we don't have any scroll frame ancestors, e.g. in a position:fixed
 sub-tree. r=roc

---
 layout/generic/StickyScrollContainer.cpp  |  4 +++-
 layout/generic/crashtests/949932.html     | 13 +++++++++++++
 layout/generic/crashtests/crashtests.list |  1 +
 3 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 layout/generic/crashtests/949932.html

diff --git a/layout/generic/StickyScrollContainer.cpp b/layout/generic/StickyScrollContainer.cpp
index bd9bb9f17fc6..245f71677eb7 100644
--- a/layout/generic/StickyScrollContainer.cpp
+++ b/layout/generic/StickyScrollContainer.cpp
@@ -93,7 +93,9 @@ StickyScrollContainer::NotifyReparentedFrameAcrossScrollFrameBoundary(nsIFrame*
     StickyScrollContainer* newSSC = GetStickyScrollContainerForFrame(f);
     if (newSSC != oldSSC) {
       oldSSC->RemoveFrame(f);
-      newSSC->AddFrame(f);
+      if (newSSC) {
+        newSSC->AddFrame(f);
+      }
     }
   }
 }
diff --git a/layout/generic/crashtests/949932.html b/layout/generic/crashtests/949932.html
new file mode 100644
index 000000000000..2b7e7a0be0be
--- /dev/null
+++ b/layout/generic/crashtests/949932.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+    <div style="position: fixed;">
+        <fieldset style="overflow: hidden;">
+            <legend style="position: sticky;"></legend>
+        </fieldset>
+    </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index add355218016..8326c07e59af 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -511,3 +511,4 @@ load 893523.html
 test-pref(layout.css.sticky.enabled,true) load 914891.html
 test-pref(layout.css.sticky.enabled,true) load 915475.xhtml
 load 943509-1.html
+test-pref(layout.css.sticky.enabled,true) load 949932.html

From 5b9d3b09ee6742d7c72aaa9050c0f771435c8dcd Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 13 Dec 2013 09:50:13 -0800
Subject: [PATCH 141/144] Bug 949878 - Switch to integer indexes to avoid
 pathological array slowdown, r=terrence

--HG--
extra : rebase_source : 93cd0bdd1bb2b1b4f104112613b3609ee4235ddd
---
 js/src/devtools/rootAnalysis/loadCallgraph.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/loadCallgraph.js b/js/src/devtools/rootAnalysis/loadCallgraph.js
index 295d3f9ce7ce..8964ca64e4a9 100644
--- a/js/src/devtools/rootAnalysis/loadCallgraph.js
+++ b/js/src/devtools/rootAnalysis/loadCallgraph.js
@@ -96,8 +96,9 @@ function loadCallgraph(file)
     // Find all functions reachable via an unsuppressed call chain, and remove
     // them from the suppressedFunctions set. Everything remaining is only
     // reachable when GC is suppressed.
-    while (worklist.length) {
-        name = worklist.pop();
+    var top = worklist.length;
+    while (top > 0) {
+        name = worklist[--top];
         if (shouldSuppressGC(name))
             continue;
         if (!(name in suppressedFunctions))
@@ -107,7 +108,7 @@ function loadCallgraph(file)
             continue;
         for (var entry of calleeGraph[name]) {
             if (!entry.suppressed)
-                worklist.push(entry.callee);
+                worklist[top++] = entry.callee;
         }
     }
 

From 3dadf354c012d72c85e41e354934392fcdd4a6a7 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Fri, 13 Dec 2013 13:30:27 -0500
Subject: [PATCH 142/144] Backed out 7 changesets (bug 949668) for Windows
 jit-test failures on a CLOSED TREE.

Backed out changeset 3786ca248031 (bug 949668)
Backed out changeset 05c4fa8d327b (bug 949668)
Backed out changeset ca7eeb4f5570 (bug 949668)
Backed out changeset ff3bdc0fb8e3 (bug 949668)
Backed out changeset 2ff5f77b2047 (bug 949668)
Backed out changeset 246083962f43 (bug 949668)
Backed out changeset 8af12200ad0b (bug 949668)
---
 js/src/jit/BacktrackingAllocator.cpp          |  19 +-
 js/src/jit/BaselineIC.cpp                     |  10 +-
 js/src/jit/CodeGenerator.cpp                  |  61 ++--
 js/src/jit/IonMacroAssembler.h                |   4 +-
 js/src/jit/LIR-Common.h                       |  13 +-
 js/src/jit/LIR.cpp                            |  15 +-
 js/src/jit/LIR.h                              |  10 +-
 js/src/jit/LinearScan.cpp                     |  35 +--
 js/src/jit/LinearScan.h                       |   2 +-
 js/src/jit/LiveRangeAllocator.cpp             |   1 -
 js/src/jit/LiveRangeAllocator.h               |  26 +-
 js/src/jit/Lowering.cpp                       |  26 +-
 js/src/jit/MoveResolver.cpp                   |   2 +-
 js/src/jit/MoveResolver.h                     | 283 +++++++++---------
 js/src/jit/RegisterAllocator.h                |   2 +-
 js/src/jit/StupidAllocator.cpp                |  23 +-
 js/src/jit/StupidAllocator.h                  |   5 +-
 js/src/jit/arm/Assembler-arm.h                |  12 +-
 js/src/jit/arm/CodeGenerator-arm.cpp          |   2 +
 js/src/jit/arm/CodeGenerator-arm.h            |   2 +-
 js/src/jit/arm/Lowering-arm.cpp               |   2 +-
 js/src/jit/arm/MacroAssembler-arm.cpp         |  72 ++---
 js/src/jit/arm/MacroAssembler-arm.h           |  23 +-
 js/src/jit/arm/MoveEmitter-arm.cpp            |  43 +--
 js/src/jit/arm/MoveEmitter-arm.h              |   9 +-
 js/src/jit/arm/Trampoline-arm.cpp             |  10 +-
 js/src/jit/shared/CodeGenerator-shared.cpp    |   2 +-
 .../jit/shared/CodeGenerator-x86-shared.cpp   |   2 +
 js/src/jit/shared/CodeGenerator-x86-shared.h  |   2 +-
 js/src/jit/shared/Lowering-shared-inl.h       |  12 +-
 js/src/jit/shared/Lowering-shared.h           |   3 +-
 js/src/jit/shared/Lowering-x86-shared.cpp     |   6 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp  |  45 +--
 js/src/jit/shared/MoveEmitter-x86-shared.h    |   7 +-
 js/src/jit/x64/MacroAssembler-x64.cpp         |  40 +--
 js/src/jit/x64/MacroAssembler-x64.h           |  21 +-
 js/src/jit/x64/Trampoline-x64.cpp             |  39 +--
 js/src/jit/x86/CodeGenerator-x86.cpp          |   4 +-
 js/src/jit/x86/MacroAssembler-x86.cpp         |  33 +-
 js/src/jit/x86/MacroAssembler-x86.h           |  21 +-
 js/src/jit/x86/Trampoline-x86.cpp             |  52 ++--
 41 files changed, 467 insertions(+), 534 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 803079fc2879..64e46a4edfcc 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -918,10 +918,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                 LiveInterval *prevInterval = reg->intervalFor(start.previous());
                 if (start.subpos() == CodePosition::INPUT) {
-                    if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
+                    if (!moveInput(inputOf(data->ins()), prevInterval, interval))
                         return false;
                 } else {
-                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
+                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
                         return false;
                 }
             }
@@ -941,8 +941,7 @@ BacktrackingAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LDefinition *def = phi->getDef(0);
-            VirtualRegister *vreg = &vregs[def];
+            VirtualRegister *vreg = &vregs[phi->getDef(0)];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -954,7 +953,7 @@ BacktrackingAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to, def->type()))
+                if (!moveAtExit(predecessor, from, to))
                     return false;
             }
         }
@@ -979,10 +978,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                     if (mSuccessor->numPredecessors() > 1) {
                         JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                        if (!moveAtExit(predecessor, from, to, reg.type()))
+                        if (!moveAtExit(predecessor, from, to))
                             return false;
                     } else {
-                        if (!moveAtEntry(successor, from, to, reg.type()))
+                        if (!moveAtEntry(successor, from, to))
                             return false;
                     }
                 }
@@ -1078,7 +1077,7 @@ BacktrackingAllocator::reifyAllocations()
 
                     if (*res != *alloc) {
                         LMoveGroup *group = getInputMoveGroup(inputOf(ins));
-                        if (!group->addAfter(sourceAlloc, res, def->type()))
+                        if (!group->addAfter(sourceAlloc, res))
                             return false;
                         *alloc = *res;
                     }
@@ -1129,9 +1128,7 @@ BacktrackingAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL ||
-                             def->type() == LDefinition::FLOAT32 ||
-                             def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index d6a5177a6081..e12f63ccfe7c 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2841,9 +2841,9 @@ ICBinaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
         break;
       case JSOP_MOD:
         masm.setupUnalignedABICall(2, R0.scratchReg());
-        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
-        masm.passABIArg(FloatReg1, MoveOp::DOUBLE);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg0);
+        masm.passABIArg(FloatReg1);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
         JS_ASSERT(ReturnFloatReg == FloatReg0);
         break;
       default:
@@ -2968,7 +2968,7 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.bind(&truncateABICall);
         masm.push(intReg);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg0);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
         masm.pop(intReg);
@@ -3117,7 +3117,7 @@ ICUnaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
 
         masm.bind(&truncateABICall);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg0);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index f0c05f4ed83b..63efbd13937e 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1,4 +1,4 @@
-/* -*- Mnde: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1185,28 +1185,15 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
 
         const LAllocation *from = move.from();
         const LAllocation *to = move.to();
-        LDefinition::Type type = move.type();
 
         // No bogus moves.
         JS_ASSERT(*from != *to);
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveOp::Kind kind;
-        switch (type) {
-          case LDefinition::OBJECT:
-          case LDefinition::SLOTS:
-#ifdef JS_NUNBOX32
-          case LDefinition::TYPE:
-          case LDefinition::PAYLOAD:
-#else
-          case LDefinition::BOX:
-#endif
-          case LDefinition::GENERAL: kind = MoveOp::GENERAL; break;
-          case LDefinition::FLOAT32: kind = MoveOp::FLOAT32; break;
-          case LDefinition::DOUBLE:  kind = MoveOp::DOUBLE;  break;
-          default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
-        }
+        MoveResolver::Move::Kind kind = from->isDouble()
+                                        ? MoveResolver::Move::DOUBLE
+                                        : MoveResolver::Move::GENERAL;
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
@@ -3058,9 +3045,9 @@ bool CodeGenerator::visitAtan2D(LAtan2D *lir)
     FloatRegister x = ToFloatRegister(lir->x());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(y, MoveOp::DOUBLE);
-    masm.passABIArg(x, MoveOp::DOUBLE);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MoveOp::DOUBLE);
+    masm.passABIArg(y);
+    masm.passABIArg(x);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3073,9 +3060,9 @@ bool CodeGenerator::visitHypot(LHypot *lir)
     FloatRegister y = ToFloatRegister(lir->y());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(x, MoveOp::DOUBLE);
-    masm.passABIArg(y, MoveOp::DOUBLE);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MoveOp::DOUBLE);
+    masm.passABIArg(x);
+    masm.passABIArg(y);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3814,10 +3801,10 @@ CodeGenerator::visitPowI(LPowI *ins)
     // its scratch register. We can therefore save an input register by
     // reusing the scratch register to pass constants to callWithABI.
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value, MoveOp::DOUBLE);
+    masm.passABIArg(value);
     masm.passABIArg(power);
 
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MacroAssembler::DOUBLE);
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     return true;
@@ -3831,9 +3818,9 @@ CodeGenerator::visitPowD(LPowD *ins)
     Register temp = ToRegister(ins->temp());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value, MoveOp::DOUBLE);
-    masm.passABIArg(power, MoveOp::DOUBLE);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MoveOp::DOUBLE);
+    masm.passABIArg(value);
+    masm.passABIArg(power);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3849,7 +3836,7 @@ CodeGenerator::visitRandom(LRandom *ins)
 
     masm.setupUnalignedABICall(1, temp2);
     masm.passABIArg(temp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3869,7 +3856,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         masm.movePtr(ImmPtr(mathCache), temp);
         masm.passABIArg(temp);
     }
-    masm.passABIArg(input, MoveOp::DOUBLE);
+    masm.passABIArg(input);
 
 #   define MAYBE_CACHED(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
 
@@ -3950,7 +3937,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
 
 #   undef MAYBE_CACHED
 
-    masm.callWithABI(funptr, MoveOp::DOUBLE);
+    masm.callWithABI(funptr, MacroAssembler::DOUBLE);
     return true;
 }
 
@@ -3962,7 +3949,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(1, temp);
-    masm.passABIArg(input, MoveOp::FLOAT32);
+    masm.passABIArg(input);
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
@@ -3979,7 +3966,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MoveOp::FLOAT32);
+    masm.callWithABI(funptr, MacroAssembler::FLOAT);
     return true;
 }
 
@@ -3993,13 +3980,13 @@ CodeGenerator::visitModD(LModD *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(lhs, MoveOp::DOUBLE);
-    masm.passABIArg(rhs, MoveOp::DOUBLE);
+    masm.passABIArg(lhs);
+    masm.passABIArg(rhs);
 
     if (gen->compilingAsmJS())
-        masm.callWithABI(AsmJSImm_ModD, MoveOp::DOUBLE);
+        masm.callWithABI(AsmJSImm_ModD, MacroAssembler::DOUBLE);
     else
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
     return true;
 }
 
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 297c1c3bb654..4a03191b8973 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -865,12 +865,12 @@ class MacroAssembler : public MacroAssemblerSpecific
     // been made so that a safepoint can be made at that location.
 
     template <typename T>
-    void callWithABINoProfiling(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
+    void callWithABINoProfiling(const T &fun, Result result = GENERAL) {
         MacroAssemblerSpecific::callWithABI(fun, result);
     }
 
     template <typename T>
-    void callWithABI(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
+    void callWithABI(const T &fun, Result result = GENERAL) {
         leaveSPSFrame();
         callWithABINoProfiling(fun, result);
         reenterSPSFrame();
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index c4d11cee87e2..8f94028624a1 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -71,13 +71,11 @@ class LMove
 {
     LAllocation *from_;
     LAllocation *to_;
-    LDefinition::Type type_;
 
   public:
-    LMove(LAllocation *from, LAllocation *to, LDefinition::Type type)
+    LMove(LAllocation *from, LAllocation *to)
       : from_(from),
-        to_(to),
-        type_(type)
+        to_(to)
     { }
 
     LAllocation *from() {
@@ -92,9 +90,6 @@ class LMove
     const LAllocation *to() const {
         return to_;
     }
-    LDefinition::Type type() const {
-        return type_;
-    }
 };
 
 class LMoveGroup : public LInstructionHelper<0, 0, 0>
@@ -115,10 +110,10 @@ class LMoveGroup : public LInstructionHelper<0, 0, 0>
     void printOperands(FILE *fp);
 
     // Add a move which takes place simultaneously with all others in the group.
-    bool add(LAllocation *from, LAllocation *to, LDefinition::Type type);
+    bool add(LAllocation *from, LAllocation *to);
 
     // Add a move which takes place after existing moves in the group.
-    bool addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type);
+    bool addAfter(LAllocation *from, LAllocation *to);
 
     size_t numMoves() const {
         return moves_.length();
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 7fef35f37b2f..fc672bdb356e 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -197,11 +197,10 @@ static const char * const TypeChars[] =
 {
     "i",            // INTEGER
     "o",            // OBJECT
-    "f",            // FLOAT32
-    "d",            // DOUBLE
+    "f",            // DOUBLE
 #ifdef JS_NUNBOX32
     "t",            // TYPE
-    "p"             // PAYLOAD
+    "d"             // PAYLOAD
 #elif JS_PUNBOX64
     "x"             // BOX
 #endif
@@ -364,18 +363,18 @@ LInstruction::initSafepoint(TempAllocator &alloc)
 }
 
 bool
-LMoveGroup::add(LAllocation *from, LAllocation *to, LDefinition::Type type)
+LMoveGroup::add(LAllocation *from, LAllocation *to)
 {
 #ifdef DEBUG
     JS_ASSERT(*from != *to);
     for (size_t i = 0; i < moves_.length(); i++)
         JS_ASSERT(*to != *moves_[i].to());
 #endif
-    return moves_.append(LMove(from, to, type));
+    return moves_.append(LMove(from, to));
 }
 
 bool
-LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
+LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
 {
     // Transform the operands to this move so that performing the result
     // simultaneously with existing moves in the group will have the same
@@ -393,12 +392,12 @@ LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
 
     for (size_t i = 0; i < moves_.length(); i++) {
         if (*to == *moves_[i].to()) {
-            moves_[i] = LMove(from, to, type);
+            moves_[i] = LMove(from, to);
             return true;
         }
     }
 
-    return add(from, to, type);
+    return add(from, to);
 }
 
 void
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 3181cd053871..1f802ba79186 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -363,6 +363,10 @@ class LStackSlot : public LAllocation
       : LAllocation(isDouble ? DOUBLE_SLOT : STACK_SLOT, slot)
     { }
 
+    bool isDouble() const {
+        return kind() == DOUBLE_SLOT;
+    }
+
     uint32_t slot() const {
         return data();
     }
@@ -442,8 +446,7 @@ class LDefinition
         GENERAL,    // Generic, integer or pointer-width data (GPR).
         OBJECT,     // Pointer that may be collected as garbage (GPR).
         SLOTS,      // Slots/elements pointer that may be moved by minor GCs (GPR).
-        FLOAT32,    // 32-bit floating-point value (FPU).
-        DOUBLE,     // 64-bit floating-point value (FPU).
+        DOUBLE,     // 64-bit point value (FPU).
 #ifdef JS_NUNBOX32
         // A type virtual register must be followed by a payload virtual
         // register, as both will be tracked as a single gcthing.
@@ -537,9 +540,8 @@ class LDefinition
           case MIRType_Object:
             return LDefinition::OBJECT;
           case MIRType_Double:
-            return LDefinition::DOUBLE;
           case MIRType_Float32:
-            return LDefinition::FLOAT32;
+            return LDefinition::DOUBLE;
 #if defined(JS_PUNBOX64)
           case MIRType_Value:
             return LDefinition::BOX;
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index 6a46531ab37b..cd22f4d36818 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -233,8 +233,7 @@ LinearScanAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LDefinition *def = phi->getDef(0);
-            LinearScanVirtualRegister *vreg = &vregs[def];
+            LinearScanVirtualRegister *vreg = &vregs[phi->getDef(0)];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -246,15 +245,14 @@ LinearScanAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to, def->type()))
+                if (!moveAtExit(predecessor, from, to))
                     return false;
             }
 
             if (vreg->mustSpillAtDefinition() && !to->isSpill()) {
                 // Make sure this phi is spilled at the loop header.
                 LMoveGroup *moves = successor->getEntryMoveGroup(alloc());
-                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill(),
-                                def->type()))
+                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill()))
                     return false;
             }
         }
@@ -285,10 +283,10 @@ LinearScanAllocator::resolveControlFlow()
 
                 if (mSuccessor->numPredecessors() > 1) {
                     JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                    if (!moveAtExit(predecessor, from, to, vreg->type()))
+                    if (!moveAtExit(predecessor, from, to))
                         return false;
                 } else {
-                    if (!moveAtEntry(successor, from, to, vreg->type()))
+                    if (!moveAtEntry(successor, from, to))
                         return false;
                 }
             }
@@ -299,13 +297,12 @@ LinearScanAllocator::resolveControlFlow()
 }
 
 bool
-LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to,
-                                    LDefinition::Type type)
+LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to)
 {
     if (*from == *to)
         return true;
     LMoveGroup *moves = getInputMoveGroup(pos);
-    return moves->add(from, to, type);
+    return moves->add(from, to);
 }
 
 static inline void
@@ -353,7 +350,7 @@ LinearScanAllocator::reifyAllocations()
                 LiveInterval *to = fixedIntervals[GetFixedRegister(reg->def(), usePos->use).code()];
 
                 *static_cast<LAllocation *>(usePos->use) = *to->getAllocation();
-                if (!moveInput(usePos->pos, interval, to, reg->type()))
+                if (!moveInput(usePos->pos, interval, to))
                     return false;
             } else {
                 JS_ASSERT(UseCompatibleWith(usePos->use, *interval->getAllocation()));
@@ -379,7 +376,7 @@ LinearScanAllocator::reifyAllocations()
                 // it should use the fixed register instead.
                 SetOsiPointUses(interval, defEnd, LAllocation(fixedReg));
 
-                if (!moveAfter(defEnd, from, interval, def->type()))
+                if (!moveAfter(defEnd, from, interval))
                     return false;
                 spillFrom = from->getAllocation();
             } else {
@@ -390,7 +387,7 @@ LinearScanAllocator::reifyAllocations()
                     JS_ASSERT(!inputAlloc->isUse());
 
                     *inputAlloc = *interval->getAllocation();
-                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc, def->type()))
+                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc))
                         return false;
                 }
 
@@ -420,7 +417,7 @@ LinearScanAllocator::reifyAllocations()
                 // or Nop instructions). Note that we explicitly ignore phis,
                 // which should have been handled in resolveControlFlow().
                 LMoveGroup *moves = getMoveGroupAfter(defEnd);
-                if (!moves->add(spillFrom, reg->canonicalSpill(), def->type()))
+                if (!moves->add(spillFrom, reg->canonicalSpill()))
                     return false;
             }
         }
@@ -446,10 +443,10 @@ LinearScanAllocator::reifyAllocations()
             JS_ASSERT(start == inputOf(data->ins()) || start == outputOf(data->ins()));
 
             if (start.subpos() == CodePosition::INPUT) {
-                if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
+                if (!moveInput(inputOf(data->ins()), prevInterval, interval))
                     return false;
             } else {
-                if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
+                if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
                     return false;
             }
 
@@ -518,9 +515,7 @@ LinearScanAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL ||
-                             def->type() == LDefinition::FLOAT32 ||
-                             def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
@@ -797,7 +792,7 @@ LinearScanAllocator::allocateSlotFor(const LiveInterval *interval)
     LinearScanVirtualRegister *reg = &vregs[interval->vreg()];
 
     SlotList *freed;
-    if (reg->type() == LDefinition::DOUBLE || reg->type() == LDefinition::FLOAT32)
+    if (reg->type() == LDefinition::DOUBLE)
         freed = &finishedDoubleSlots_;
 #ifdef JS_NUNBOX32
     else if (IsNunbox(reg))
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index cf194b9e20b9..64ce47d9191a 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -111,7 +111,7 @@ class LinearScanAllocator
     AnyRegister::Code findBestFreeRegister(CodePosition *freeUntil);
     AnyRegister::Code findBestBlockedRegister(CodePosition *nextUsed);
     bool canCoexist(LiveInterval *a, LiveInterval *b);
-    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to, LDefinition::Type type);
+    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to);
     void setIntervalRequirement(LiveInterval *interval);
     bool isSpilledAt(LiveInterval *interval, CodePosition pos);
 
diff --git a/js/src/jit/LiveRangeAllocator.cpp b/js/src/jit/LiveRangeAllocator.cpp
index 0d457286657e..361fdb60ebcd 100644
--- a/js/src/jit/LiveRangeAllocator.cpp
+++ b/js/src/jit/LiveRangeAllocator.cpp
@@ -468,7 +468,6 @@ AddRegisterToSafepoint(LSafepoint *safepoint, AnyRegister reg, const LDefinition
 
     JS_ASSERT(def.type() == LDefinition::GENERAL ||
               def.type() == LDefinition::DOUBLE ||
-              def.type() == LDefinition::FLOAT32 ||
               def.type() == LDefinition::OBJECT);
 
     if (def.type() == LDefinition::OBJECT)
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index 993f1c495451..a469ebda4aeb 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -136,7 +136,7 @@ static inline bool
 DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation alloc)
 {
     if (ins->isPhi()) {
-        if (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
+        if (def->type() == LDefinition::DOUBLE)
             return alloc.isFloatReg() || alloc.kind() == LAllocation::DOUBLE_SLOT;
         return alloc.isGeneralReg() || alloc.kind() == LAllocation::STACK_SLOT;
     }
@@ -145,7 +145,7 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::DEFAULT:
         if (!alloc.isRegister())
             return false;
-        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32);
+        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE);
       case LDefinition::PRESET:
         return alloc == *def->output();
       case LDefinition::MUST_REUSE_INPUT:
@@ -473,7 +473,7 @@ class VirtualRegister
         return intervals_.insert(found, interval);
     }
     bool isDouble() const {
-        return def_->type() == LDefinition::DOUBLE || def_->type() == LDefinition::FLOAT32;
+        return def_->type() == LDefinition::DOUBLE;
     }
 
     LiveInterval *intervalFor(CodePosition pos);
@@ -633,37 +633,37 @@ class LiveRangeAllocator : protected RegisterAllocator
     }
 #endif
 
-    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to) {
         JS_ASSERT(*from->getAllocation() != *to->getAllocation());
-        return moves->add(from->getAllocation(), to->getAllocation(), type);
+        return moves->add(from->getAllocation(), to->getAllocation());
     }
 
-    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getInputMoveGroup(pos);
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
-    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getMoveGroupAfter(pos);
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
-    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getExitMoveGroup(alloc());
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
-    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getEntryMoveGroup(alloc());
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
     size_t findFirstNonCallSafepoint(CodePosition from) const
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 67d8af974949..480ca2ae611f 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -660,7 +660,7 @@ LIRGenerator::visitTest(MTest *test)
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
-        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempDouble(), temp0, temp1);
+        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
@@ -1027,7 +1027,7 @@ LIRGenerator::visitTypeOf(MTypeOf *ins)
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
-    LToIdV *lir = new(alloc()) LToIdV(tempDouble());
+    LToIdV *lir = new(alloc()) LToIdV(tempFloat());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
@@ -1176,7 +1176,7 @@ bool
 LIRGenerator::visitRound(MRound *ins)
 {
     JS_ASSERT(ins->num()->type() == MIRType_Double);
-    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempDouble());
+    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempFloat());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
@@ -1755,7 +1755,7 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::NORMAL);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
@@ -1800,7 +1800,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::TRUNCATE);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
@@ -2026,7 +2026,7 @@ LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 
     LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
                                                                     useRegisterAtStart(ins->value()),
-                                                                    tempDouble());
+                                                                    tempFloat());
     return defineBox(lir, ins);
 }
 
@@ -2343,7 +2343,7 @@ LIRGenerator::visitNot(MNot *ins)
             temp1 = LDefinition::BogusTemp();
         }
 
-        LNotV *lir = new(alloc()) LNotV(tempDouble(), temp0, temp1);
+        LNotV *lir = new(alloc()) LNotV(tempFloat(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
@@ -2626,7 +2626,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 
       case MIRType_Value:
       {
-        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempDouble());
+        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempFloat());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
@@ -2913,15 +2913,15 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       case MIRType_Double:
-        lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempFloat());
         break;
 
       case MIRType_Float32:
-        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat32());
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat());
         break;
 
       case MIRType_Value:
-        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempDouble(), tempDouble());
+        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
@@ -3027,7 +3027,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
-                                             temp(), tempDouble());
+                                             temp(), tempFloat());
 
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
@@ -3036,7 +3036,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     } else {
         lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
                                              useRegisterOrConstant(ins->value()),
-                                             tempToUnbox(), temp(), tempDouble());
+                                             tempToUnbox(), temp(), tempFloat());
 
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
diff --git a/js/src/jit/MoveResolver.cpp b/js/src/jit/MoveResolver.cpp
index 4354f24d8ef5..522bd3b17470 100644
--- a/js/src/jit/MoveResolver.cpp
+++ b/js/src/jit/MoveResolver.cpp
@@ -21,7 +21,7 @@ MoveResolver::resetState()
 }
 
 bool
-MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
+MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
 {
     // Assert that we're not doing no-op moves.
     JS_ASSERT(!(from == to));
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index acb1492051d6..601113b8ac01 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -14,156 +14,163 @@
 namespace js {
 namespace jit {
 
-// This is similar to Operand, but carries more information. We're also not
-// guaranteed that Operand looks like this on all ISAs.
-class MoveOperand
-{
-  public:
-    enum Kind {
-        // A register in the "integer", aka "general purpose", class.
-        REG,
-        // A register in the "float" register class.
-        FLOAT_REG,
-        // A memory region.
-        MEMORY,
-        // The address of a memory region.
-        EFFECTIVE_ADDRESS
-    };
-
-  private:
-    Kind kind_;
-    uint32_t code_;
-    int32_t disp_;
-
-  public:
-    MoveOperand()
-    { }
-    explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
-    { }
-    explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
-    { }
-    MoveOperand(const Register &reg, int32_t disp, Kind kind = MEMORY)
-        : kind_(kind),
-        code_(reg.code()),
-        disp_(disp)
-    {
-        JS_ASSERT(isMemoryOrEffectiveAddress());
-
-        // With a zero offset, this is a plain reg-to-reg move.
-        if (disp == 0 && kind_ == EFFECTIVE_ADDRESS)
-            kind_ = REG;
-    }
-    MoveOperand(const MoveOperand &other)
-      : kind_(other.kind_),
-        code_(other.code_),
-        disp_(other.disp_)
-    { }
-    bool isFloatReg() const {
-        return kind_ == FLOAT_REG;
-    }
-    bool isGeneralReg() const {
-        return kind_ == REG;
-    }
-    bool isMemory() const {
-        return kind_ == MEMORY;
-    }
-    bool isEffectiveAddress() const {
-        return kind_ == EFFECTIVE_ADDRESS;
-    }
-    bool isMemoryOrEffectiveAddress() const {
-        return isMemory() || isEffectiveAddress();
-    }
-    Register reg() const {
-        JS_ASSERT(isGeneralReg());
-        return Register::FromCode(code_);
-    }
-    FloatRegister floatReg() const {
-        JS_ASSERT(isFloatReg());
-        return FloatRegister::FromCode(code_);
-    }
-    Register base() const {
-        JS_ASSERT(isMemoryOrEffectiveAddress());
-        return Register::FromCode(code_);
-    }
-    int32_t disp() const {
-        JS_ASSERT(isMemoryOrEffectiveAddress());
-        return disp_;
-    }
-
-    bool operator ==(const MoveOperand &other) const {
-        if (kind_ != other.kind_)
-            return false;
-        if (code_ != other.code_)
-            return false;
-        if (isMemoryOrEffectiveAddress())
-            return disp_ == other.disp_;
-        return true;
-    }
-    bool operator !=(const MoveOperand &other) const {
-        return !operator==(other);
-    }
-};
-
-// This represents a move operation.
-class MoveOp
-{
-  protected:
-    MoveOperand from_;
-    MoveOperand to_;
-    bool cycle_;
-
-  public:
-    enum Kind {
-        GENERAL,
-        FLOAT32,
-        DOUBLE
-    };
-
-  protected:
-    Kind kind_;
-
-  public:
-    MoveOp()
-    { }
-    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind)
-      : from_(from),
-        to_(to),
-        cycle_(false),
-        kind_(kind)
-    { }
-
-    bool inCycle() const {
-        return cycle_;
-    }
-    const MoveOperand &from() const {
-        return from_;
-    }
-    const MoveOperand &to() const {
-        return to_;
-    }
-    Kind kind() const {
-        return kind_;
-    }
-};
-
 class MoveResolver
 {
+  public:
+    // This is similar to Operand, but carries more information. We're also not
+    // guaranteed that Operand looks like this on all ISAs.
+    class MoveOperand
+    {
+        enum Kind {
+            REG,
+            FLOAT_REG,
+            ADDRESS,
+            FLOAT_ADDRESS,
+            EFFECTIVE_ADDRESS
+        };
+
+        Kind kind_;
+        uint32_t code_;
+        int32_t disp_;
+
+      public:
+        enum AddressKind {
+            MEMORY = ADDRESS,
+            EFFECTIVE = EFFECTIVE_ADDRESS,
+            FLOAT = FLOAT_ADDRESS
+        };
+
+        MoveOperand()
+        { }
+        explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
+        { }
+        explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
+        { }
+        MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
+            : kind_((Kind) addrKind),
+            code_(reg.code()),
+            disp_(disp)
+        {
+            // With a zero offset, this is a plain reg-to-reg move.
+            if (disp == 0 && addrKind == EFFECTIVE)
+                kind_ = REG;
+        }
+        MoveOperand(const MoveOperand &other)
+          : kind_(other.kind_),
+            code_(other.code_),
+            disp_(other.disp_)
+        { }
+        bool isFloatReg() const {
+            return kind_ == FLOAT_REG;
+        }
+        bool isGeneralReg() const {
+            return kind_ == REG;
+        }
+        bool isDouble() const {
+            return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
+        }
+        bool isMemory() const {
+            return kind_ == ADDRESS;
+        }
+        bool isFloatAddress() const {
+            return kind_ == FLOAT_ADDRESS;
+        }
+        bool isEffectiveAddress() const {
+            return kind_ == EFFECTIVE_ADDRESS;
+        }
+        Register reg() const {
+            JS_ASSERT(isGeneralReg());
+            return Register::FromCode(code_);
+        }
+        FloatRegister floatReg() const {
+            JS_ASSERT(isFloatReg());
+            return FloatRegister::FromCode(code_);
+        }
+        Register base() const {
+            JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+            return Register::FromCode(code_);
+        }
+        int32_t disp() const {
+            return disp_;
+        }
+
+        bool operator ==(const MoveOperand &other) const {
+            if (kind_ != other.kind_)
+                return false;
+            if (code_ != other.code_)
+                return false;
+            if (isMemory() || isEffectiveAddress())
+                return disp_ == other.disp_;
+            return true;
+        }
+        bool operator !=(const MoveOperand &other) const {
+            return !operator==(other);
+        }
+    };
+
+    class Move
+    {
+      protected:
+        MoveOperand from_;
+        MoveOperand to_;
+        bool cycle_;
+
+      public:
+        enum Kind {
+            GENERAL,
+            DOUBLE
+        };
+
+      protected:
+        Kind kind_;
+
+      public:
+        Move()
+        { }
+        Move(const Move &other)
+          : from_(other.from_),
+            to_(other.to_),
+            cycle_(other.cycle_),
+            kind_(other.kind_)
+        { }
+        Move(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+          : from_(from),
+            to_(to),
+            cycle_(cycle),
+            kind_(kind)
+        { }
+
+        bool inCycle() const {
+            return cycle_;
+        }
+        const MoveOperand &from() const {
+            return from_;
+        }
+        const MoveOperand &to() const {
+            return to_;
+        }
+        Kind kind() const {
+            return kind_;
+        }
+    };
+
   private:
     struct PendingMove
-      : public MoveOp,
+      : public Move,
         public TempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : MoveOp(from, to, kind)
+          : Move(from, to, kind, false)
         { }
-
+        
         void setInCycle() {
             JS_ASSERT(!inCycle());
             cycle_ = true;
         }
+
     };
 
     typedef InlineList<MoveResolver::PendingMove>::iterator PendingMoveIterator;
@@ -171,7 +178,7 @@ class MoveResolver
   private:
     // Moves that are definitely unblocked (constants to registers). These are
     // emitted last.
-    js::Vector<MoveOp, 16, SystemAllocPolicy> orderedMoves_;
+    js::Vector<Move, 16, SystemAllocPolicy> orderedMoves_;
     bool hasCycles_;
 
     TempObjectPool<PendingMove> movePool_;
@@ -193,13 +200,13 @@ class MoveResolver
     //
     // After calling addMove() for each parallel move, resolve() performs the
     // cycle resolution algorithm. Calling addMove() again resets the resolver.
-    bool addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    bool addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
     bool resolve();
 
     size_t numMoves() const {
         return orderedMoves_.length();
     }
-    const MoveOp &getMove(size_t i) const {
+    const Move &getMove(size_t i) const {
         return orderedMoves_[i];
     }
     bool hasCycles() const {
diff --git a/js/src/jit/RegisterAllocator.h b/js/src/jit/RegisterAllocator.h
index f5f0d2770cfd..e6059eaef31d 100644
--- a/js/src/jit/RegisterAllocator.h
+++ b/js/src/jit/RegisterAllocator.h
@@ -369,7 +369,7 @@ class RegisterAllocator
 static inline AnyRegister
 GetFixedRegister(const LDefinition *def, const LUse *use)
 {
-    return (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
+    return def->type() == LDefinition::DOUBLE
            ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
            : AnyRegister(Register::FromCode(use->registerCode()));
 }
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 8f9751faba72..921bdf9d08d4 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -28,9 +28,7 @@ StupidAllocator::stackLocation(uint32_t vreg)
     if (def->policy() == LDefinition::PRESET && def->output()->isArgument())
         return def->output();
 
-    return new(alloc()) LStackSlot(DefaultStackSlot(vreg),
-                                   def->type() == LDefinition::DOUBLE ||
-                                   def->type() == LDefinition::FLOAT32);
+    return new(alloc()) LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
 }
 
 StupidAllocator::RegisterIndex
@@ -143,7 +141,7 @@ StupidAllocator::ensureHasRegister(LInstruction *ins, uint32_t vreg)
     }
 
     RegisterIndex best = allocateRegister(ins, vreg);
-    loadRegister(ins, vreg, best, virtualRegisters[vreg]->type());
+    loadRegister(ins, vreg, best);
 
     return registers[best].reg;
 }
@@ -164,7 +162,7 @@ StupidAllocator::allocateRegister(LInstruction *ins, uint32_t vreg)
     for (size_t i = 0; i < registerCount; i++) {
         AnyRegister reg = registers[i].reg;
 
-        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32))
+        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE))
             continue;
 
         // Skip the register if it is in use for an allocated input or output.
@@ -192,7 +190,7 @@ StupidAllocator::syncRegister(LInstruction *ins, RegisterIndex index)
 
         uint32_t existing = registers[index].vreg;
         LAllocation *dest = stackLocation(existing);
-        input->addAfter(source, dest, registers[index].type);
+        input->addAfter(source, dest);
 
         registers[index].dirty = false;
     }
@@ -206,15 +204,14 @@ StupidAllocator::evictRegister(LInstruction *ins, RegisterIndex index)
 }
 
 void
-StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type)
+StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index)
 {
     // Load a vreg from its stack location to a register.
     LMoveGroup *input = getInputMoveGroup(ins->id());
     LAllocation *source = stackLocation(vreg);
     LAllocation *dest = new(alloc()) LAllocation(registers[index].reg);
-    input->addAfter(source, dest, type);
+    input->addAfter(source, dest);
     registers[index].set(vreg, ins);
-    registers[index].type = type;
 }
 
 StupidAllocator::RegisterIndex
@@ -313,7 +310,7 @@ StupidAllocator::syncForBlockEnd(LBlock *block, LInstruction *ins)
                 }
             }
 
-            group->add(source, dest, phi->getDef(0)->type());
+            group->add(source, dest);
         }
     }
 }
@@ -337,14 +334,14 @@ StupidAllocator::allocateForInstruction(LInstruction *ins)
             AnyRegister reg = ensureHasRegister(ins, vreg);
             alloc.replace(LAllocation(reg));
         } else if (use->policy() == LUse::FIXED) {
-            AnyRegister reg = GetFixedRegister(virtualRegisters[vreg], use);
+            AnyRegister reg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
             RegisterIndex index = registerIndex(reg);
             if (registers[index].vreg != vreg) {
                 evictRegister(ins, index);
                 RegisterIndex existing = findExistingRegister(vreg);
                 if (existing != UINT32_MAX)
                     evictRegister(ins, existing);
-                loadRegister(ins, vreg, index, virtualRegisters[vreg]->type());
+                loadRegister(ins, vreg, index);
             }
             alloc.replace(LAllocation(reg));
         } else {
@@ -410,7 +407,6 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
                           : ins->getOperand(def->getReusedInput())->toRegister());
         evictRegister(ins, index);
         registers[index].set(vreg, ins, true);
-        registers[index].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[index].reg));
     } else if (def->policy() == LDefinition::PRESET) {
         // The result must be a stack location.
@@ -419,7 +415,6 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
         // Find a register to hold the result of the instruction.
         RegisterIndex best = allocateRegister(ins, vreg);
         registers[best].set(vreg, ins, true);
-        registers[best].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[best].reg));
     }
 }
diff --git a/js/src/jit/StupidAllocator.h b/js/src/jit/StupidAllocator.h
index e7891b65a264..f48befa0ff8b 100644
--- a/js/src/jit/StupidAllocator.h
+++ b/js/src/jit/StupidAllocator.h
@@ -22,9 +22,6 @@ class StupidAllocator : public RegisterAllocator
     struct AllocatedRegister {
         AnyRegister reg;
 
-        // The type of the value in the register.
-        LDefinition::Type type;
-
         // Virtual register this physical reg backs, or MISSING_ALLOCATION.
         uint32_t vreg;
 
@@ -75,7 +72,7 @@ class StupidAllocator : public RegisterAllocator
 
     void syncRegister(LInstruction *ins, RegisterIndex index);
     void evictRegister(LInstruction *ins, RegisterIndex index);
-    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type);
+    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index);
 
     RegisterIndex findExistingRegister(uint32_t vreg);
 
diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index 9c5107672729..362d7d183470 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -2152,19 +2152,9 @@ GetIntArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *paddi
 }
 
 static inline uint32_t
-GetFloat32ArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
+GetFloatArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
 {
-    JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
-    uint32_t intSlots = 0;
-    if (usedIntArgs > NumIntArgRegs)
-        intSlots = usedIntArgs - NumIntArgRegs;
-    uint32_t float32Slots = usedFloatArgs - NumFloatArgRegs;
-    return (intSlots + float32Slots + *padding) * STACK_SLOT_SIZE;
-}
 
-static inline uint32_t
-GetDoubleArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
-{
     JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
     uint32_t intSlots = 0;
     if (usedIntArgs > NumIntArgRegs) {
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index c53edb5bf8c8..ae1984e96efc 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1020,6 +1020,8 @@ CodeGeneratorARM::visitPowHalfD(LPowHalfD *ins)
     return true;
 }
 
+typedef MoveResolver::MoveOperand MoveOperand;
+
 MoveOperand
 CodeGeneratorARM::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/arm/CodeGenerator-arm.h b/js/src/jit/arm/CodeGenerator-arm.h
index 08c90dfd8920..a916315a485b 100644
--- a/js/src/jit/arm/CodeGenerator-arm.h
+++ b/js/src/jit/arm/CodeGenerator-arm.h
@@ -43,7 +43,7 @@ class CodeGeneratorARM : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutFrom(Label *label, LSnapshot *snapshot);
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index b74971f3e3f6..8f4ca0c78d19 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -362,7 +362,7 @@ LIRGeneratorARM::newLTableSwitch(const LAllocation &in, const LDefinition &input
 LTableSwitchV *
 LIRGeneratorARM::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempDouble(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempFloat(), tableswitch);
 }
 
 bool
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 64fbbf5b9f23..fe039c5ec771 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3508,79 +3508,63 @@ MacroAssemblerARMCompat::setupUnalignedABICall(uint32_t args, const Register &sc
 }
 #ifdef JS_CPU_ARM_HARDFP
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
 {
     MoveOperand to;
     ++passedArgs_;
     if (!enoughMemory_)
         return;
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE: {
+    if (from.isDouble()) {
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
-            if (from.isFloatReg() && from.floatReg() == fr) {
-                // Nothing to do; the value is in the right register already
-                return;
+            if (!from.isFloatReg() || from.floatReg() != fr) {
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), Move::DOUBLE);
             }
-            to = MoveOperand(fr);
+            // else nothing to do; the value is in the right register already
         } else {
             // If (and only if) the integer registers have started spilling, do we
-            // need to take the register's alignment into account
+            // need to take the double register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            to = MoveOperand(sp, disp);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::DOUBLE);
         }
         usedFloatSlots_++;
-        break;
-      }
-      case MoveOp::GENERAL: {
+    } else {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
-            if (from.isGeneralReg() && from.reg() == r) {
-                // Nothing to do; the value is in the right register already
-                return;
+            if (!from.isGeneralReg() || from.reg() != r) {
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), Move::GENERAL);
             }
-            to = MoveOperand(r);
+            // else nothing to do; the value is in the right register already
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            to = MoveOperand(sp, disp);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::GENERAL);
         }
         usedIntSlots_++;
-        break;
-      }
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
-    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 #else
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
 {
     MoveOperand to;
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    switch (kind) {
-      case MoveOp::DOUBLE:
+    Move::Kind kind = Move::GENERAL;
+    if (from.isDouble()) {
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        break;
-      case MoveOp::FLOAT32:
-      case MoveOp::GENERAL:
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+        kind = Move::DOUBLE;
     }
 
     Register destReg;
     MoveOperand dest;
     if (GetIntArgReg(usedSlots_, 0, &destReg)) {
-        if (kind == MoveOp::DOUBLE || kind == MoveOp::FLOAT32) {
+        if (from.isDouble()) {
             floatArgsInGPR[destReg.code() >> 1] = from;
             floatArgsInGPRValid[destReg.code() >> 1] = true;
             useResolver = false;
@@ -3604,13 +3588,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 void
 MacroAssemblerARMCompat::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
+    passABIArg(MoveOperand(reg));
 }
 
 void
-MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg, MoveOp::Kind kind)
+MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg)
 {
-    passABIArg(MoveOperand(freg), kind);
+    passABIArg(MoveOperand(freg));
 }
 
 void MacroAssemblerARMCompat::checkStackAlignment()
@@ -3658,7 +3642,7 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
             if (from.isFloatReg()) {
                 ma_vxfer(VFPRegister(from.floatReg()), to0, to1);
             } else {
-                JS_ASSERT(from.isMemory());
+                JS_ASSERT(from.isFloatAddress());
                 // Note: We can safely use the MoveOperand's displacement here,
                 // even if the base is SP: MoveEmitter::toOperand adjusts
                 // SP-relative operands by the difference between the current
@@ -3680,25 +3664,25 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, Result result)
 {
     if (secondScratchReg_ != lr)
         ma_mov(secondScratchReg_, lr);
 
     switch (result) {
-      case MoveOp::DOUBLE:
+      case DOUBLE:
 #ifndef JS_CPU_ARM_HARDFP
         // Move double from r0/r1 to ReturnFloatReg.
         as_vxfer(r0, r1, ReturnFloatReg, CoreToFloat);
         break;
 #endif
-      case MoveOp::FLOAT32:
+      case FLOAT:
 #ifndef JS_CPU_ARM_HARDFP
         // Move float32 from r0 to ReturnFloatReg.
         as_vxfer(r0, InvalidReg, VFPRegister(d0).singleOverlay(), CoreToFloat);
         break;
 #endif
-      case MoveOp::GENERAL:
+      case GENERAL:
         break;
 
       default:
@@ -3718,7 +3702,7 @@ MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind resu
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABI(void *fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3727,7 +3711,7 @@ MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3736,7 +3720,7 @@ MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(const Address &fun, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABI(const Address &fun, Result result)
 {
     // Load the callee in r12, no instruction between the ldr and call
     // should clobber it. Note that we can't use fun.base because it may
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 91612e990896..9fb423cb43b1 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -462,7 +462,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // Used to work around the move resolver's lack of support for
     // moving into register pairs, which the softfp ABI needs.
-    mozilla::Array<MoveOperand, 2> floatArgsInGPR;
+    mozilla::Array<MoveResolver::MoveOperand, 2> floatArgsInGPR;
     mozilla::Array<bool, 2> floatArgsInGPRValid;
 
     // Compute space needed for the function call and set the properties of the
@@ -485,6 +485,15 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
+    typedef MoveResolver::MoveOperand MoveOperand;
+    typedef MoveResolver::Move Move;
+
+    enum Result {
+        GENERAL,
+        DOUBLE,
+        FLOAT
+    };
+
     MacroAssemblerARMCompat()
       : inCall_(false),
         enoughMemory_(true),
@@ -1403,9 +1412,9 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
+    void passABIArg(const MoveOperand &from);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
+    void passABIArg(const FloatRegister &reg);
     void passABIArg(const ValueOperand &regs);
 
   protected:
@@ -1413,13 +1422,13 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
+    void callWithABIPost(uint32_t stackAdjust, Result result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(void *fun, Result result = GENERAL);
+    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
+    void callWithABI(const Address &fun, Result result = GENERAL);
 
     CodeOffsetLabel labelForPatch() {
         return CodeOffsetLabel(nextOffset().getOffset());
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index 549d9f6e1a05..72fabee9a4e1 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -58,7 +58,7 @@ MoveEmitterARM::spillSlot() const
 Operand
 MoveEmitterARM::toOperand(const MoveOperand &operand, bool isFloat) const
 {
-    if (operand.isMemoryOrEffectiveAddress()) {
+    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress()) {
         if (operand.base() != StackPointer) {
             JS_ASSERT(operand.disp() < 1024 && operand.disp() > -1024);
             return Operand(operand.base(), operand.disp());
@@ -100,7 +100,7 @@ MoveEmitterARM::tempReg()
 }
 
 void
-MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -108,9 +108,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -118,8 +116,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
         } else {
             masm.ma_vstr(to.floatReg(), cycleSlot());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         // an non-vfp value
         if (to.isMemory()) {
             Register temp = tempReg();
@@ -133,14 +130,11 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
             }
             masm.ma_str(to.reg(), cycleSlot());
         }
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
 void
-MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -148,9 +142,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -158,8 +150,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
         } else {
             masm.ma_vldr(cycleSlot(), to.floatReg());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         if (to.isMemory()) {
             Register temp = tempReg();
             masm.ma_ldr(cycleSlot(), temp);
@@ -171,9 +162,6 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
             }
             masm.ma_ldr(cycleSlot(), to.reg());
         }
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -205,7 +193,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
             MOZ_ASSUME_UNREACHABLE("strange move!");
         }
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemoryOrEffectiveAddress());
+        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), to.reg());
         else
@@ -214,7 +202,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
         // Memory to memory gpr move.
         Register reg = tempReg();
 
-        JS_ASSERT(from.isMemoryOrEffectiveAddress());
+        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), reg);
         else
@@ -244,7 +232,7 @@ MoveEmitterARM::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
 }
 
 void
-MoveEmitterARM::emit(const MoveOp &move)
+MoveEmitterARM::emit(const Move &move)
 {
     const MoveOperand &from = move.from();
     const MoveOperand &to = move.to();
@@ -260,17 +248,10 @@ MoveEmitterARM::emit(const MoveOp &move)
         inCycle_ = true;
     }
 
-    switch (move.kind()) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (move.kind() == Move::DOUBLE)
         emitDoubleMove(from, to);
-        break;
-      case MoveOp::GENERAL:
+    else
         emitMove(from, to);
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
-    }
 }
 
 void
diff --git a/js/src/jit/arm/MoveEmitter-arm.h b/js/src/jit/arm/MoveEmitter-arm.h
index c1dca9f5f38f..049dc28fdf13 100644
--- a/js/src/jit/arm/MoveEmitter-arm.h
+++ b/js/src/jit/arm/MoveEmitter-arm.h
@@ -17,6 +17,9 @@ class CodeGenerator;
 
 class MoveEmitterARM
 {
+    typedef MoveResolver::Move Move;
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     bool inCycle_;
     MacroAssemblerARMCompat &masm;
 
@@ -46,9 +49,9 @@ class MoveEmitterARM
 
     void emitMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
-    void completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
-    void emit(const MoveOp &move);
+    void breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    void completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    void emit(const Move &move);
 
   public:
     MoveEmitterARM(MacroAssemblerARMCompat &masm);
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index a53d0d02dd9d..33478fb93f74 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -654,6 +654,8 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
     VMWrapperMap::AddPtr p = functionWrappers_->lookupForAdd(&f);
@@ -735,22 +737,22 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         MoveOperand from;
         switch (f.argProperties(explicitArg)) {
           case VMFunction::WordByValue:
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            masm.passABIArg(MoveOperand(argsBase, argDisp));
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByValue:
             // Values should be passed by reference, not by value, so we
             // assert that the argument is a double-precision float.
             JS_ASSERT(f.argPassedInFloatReg(explicitArg));
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
             argDisp += sizeof(double);
             break;
           case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
             argDisp += 2 * sizeof(void *);
             break;
         }
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index 4441b399e9a7..0d4307d54982 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -767,7 +767,7 @@ CodeGeneratorShared::visitOutOfLineTruncateSlow(OutOfLineTruncateSlow *ool)
     }
 
     masm.setupUnalignedABICall(1, dest);
-    masm.passABIArg(src, MoveOp::DOUBLE);
+    masm.passABIArg(src);
     if (gen->compilingAsmJS())
         masm.callWithABI(AsmJSImm_ToInt32);
     else
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index 2a563f422cac..e7a1fff0ccc7 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1329,6 +1329,8 @@ CodeGeneratorX86Shared::visitUrshD(LUrshD *ins)
     return true;
 }
 
+typedef MoveResolver::MoveOperand MoveOperand;
+
 MoveOperand
 CodeGeneratorX86Shared::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.h b/js/src/jit/shared/CodeGenerator-x86-shared.h
index 5ec76b33da0a..8525a41ab8dd 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.h
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.h
@@ -49,7 +49,7 @@ class CodeGeneratorX86Shared : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutIf(Assembler::DoubleCondition condition, LSnapshot *snapshot);
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index fcc6fdc68ca7..940d346cae9d 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -149,14 +149,12 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
 #endif
         break;
       case MIRType_Float32:
-        lir->setDef(0, LDefinition(vreg, LDefinition::FLOAT32, LFloatReg(ReturnFloatReg)));
-        break;
       case MIRType_Double:
         lir->setDef(0, LDefinition(vreg, LDefinition::DOUBLE, LFloatReg(ReturnFloatReg)));
         break;
       default:
         LDefinition::Type type = LDefinition::TypeFrom(mir->type());
-        JS_ASSERT(type != LDefinition::DOUBLE && type != LDefinition::FLOAT32);
+        JS_ASSERT(type != LDefinition::DOUBLE);
         lir->setDef(0, LDefinition(vreg, type, LGeneralReg(ReturnReg)));
         break;
     }
@@ -423,13 +421,7 @@ LIRGeneratorShared::tempFixed(Register reg)
 }
 
 LDefinition
-LIRGeneratorShared::tempFloat32()
-{
-    return temp(LDefinition::FLOAT32);
-}
-
-LDefinition
-LIRGeneratorShared::tempDouble()
+LIRGeneratorShared::tempFloat()
 {
     return temp(LDefinition::DOUBLE);
 }
diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
index 35075335af13..fdfb74276682 100644
--- a/js/src/jit/shared/Lowering-shared.h
+++ b/js/src/jit/shared/Lowering-shared.h
@@ -104,8 +104,7 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
     // These create temporary register requests.
     inline LDefinition temp(LDefinition::Type type = LDefinition::GENERAL,
                             LDefinition::Policy policy = LDefinition::DEFAULT);
-    inline LDefinition tempFloat32();
-    inline LDefinition tempDouble();
+    inline LDefinition tempFloat();
     inline LDefinition tempCopy(MDefinition *input, uint32_t reusedInput);
 
     // Note that the fixed register has a GENERAL type.
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 71d687543dfa..8895dba562bc 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -27,7 +27,7 @@ LIRGeneratorX86Shared::newLTableSwitch(const LAllocation &in, const LDefinition
 LTableSwitchV *
 LIRGeneratorX86Shared::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempDouble(), temp(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
 }
 
 bool
@@ -333,7 +333,7 @@ LIRGeneratorX86Shared::lowerTruncateDToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempDouble();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
     return define(new(alloc()) LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
 }
 
@@ -343,6 +343,6 @@ LIRGeneratorX86Shared::lowerTruncateFToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat32();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
     return define(new(alloc()) LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
 }
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 597926d11770..55ce862e0c6d 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -27,7 +27,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     size_t swapCount = 0;
 
     for (size_t j = i; ; j++) {
-        const MoveOp &move = moves.getMove(j);
+        const Move &move = moves.getMove(j);
 
         // If it isn't a cycle of registers of the same kind, we won't be able
         // to optimize it.
@@ -56,7 +56,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     }
 
     // Check that the last move cycles back to the first move.
-    const MoveOp &move = moves.getMove(i + swapCount);
+    const Move &move = moves.getMove(i + swapCount);
     if (move.from() != moves.getMove(i).to()) {
         *allGeneralRegs = false;
         *allFloatRegs = false;
@@ -99,7 +99,7 @@ void
 MoveEmitterX86::emit(const MoveResolver &moves)
 {
     for (size_t i = 0; i < moves.numMoves(); i++) {
-        const MoveOp &move = moves.getMove(i);
+        const Move &move = moves.getMove(i);
         const MoveOperand &from = move.from();
         const MoveOperand &to = move.to();
 
@@ -128,17 +128,10 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        switch (move.kind()) {
-          case MoveOp::FLOAT32:
-          case MoveOp::DOUBLE:
+        if (move.kind() == Move::DOUBLE)
             emitDoubleMove(from, to);
-            break;
-          case MoveOp::GENERAL:
+        else
             emitGeneralMove(from, to);
-            break;
-          default:
-            MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
-        }
     }
 }
 
@@ -177,7 +170,7 @@ MoveEmitterX86::toAddress(const MoveOperand &operand) const
 Operand
 MoveEmitterX86::toOperand(const MoveOperand &operand) const
 {
-    if (operand.isMemoryOrEffectiveAddress())
+    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress())
         return Operand(toAddress(operand));
     if (operand.isGeneralReg())
         return Operand(operand.reg());
@@ -211,7 +204,7 @@ MoveEmitterX86::toPopOperand(const MoveOperand &operand) const
 }
 
 void
-MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -219,26 +212,20 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
         } else {
             masm.storeDouble(to.floatReg(), cycleSlot());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         masm.Push(toOperand(to));
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
 void
-MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -246,25 +233,19 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
         } else {
             masm.loadDouble(cycleSlot(), to.floatReg());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         if (to.isMemory()) {
             masm.Pop(toPopOperand(to));
         } else {
             masm.Pop(to.reg());
         }
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -274,7 +255,7 @@ MoveEmitterX86::emitGeneralMove(const MoveOperand &from, const MoveOperand &to)
     if (from.isGeneralReg()) {
         masm.mov(from.reg(), toOperand(to));
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemoryOrEffectiveAddress());
+        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
         if (from.isMemory())
             masm.loadPtr(toAddress(from), to.reg());
         else
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.h b/js/src/jit/shared/MoveEmitter-x86-shared.h
index 01636af4d063..b7d8fe7446df 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.h
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.h
@@ -23,6 +23,9 @@ class CodeGenerator;
 
 class MoveEmitterX86
 {
+    typedef MoveResolver::Move Move;
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     bool inCycle_;
     MacroAssemblerSpecific &masm;
 
@@ -45,8 +48,8 @@ class MoveEmitterX86
                                  bool allGeneralRegs, bool allFloatRegs, size_t swapCount);
     void emitGeneralMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &to, MoveOp::Kind kind);
-    void completeCycle(const MoveOperand &to, MoveOp::Kind kind);
+    void breakCycle(const MoveOperand &to, Move::Kind kind);
+    void completeCycle(const MoveOperand &to, Move::Kind kind);
 
   public:
     MoveEmitterX86(MacroAssemblerSpecific &masm);
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index db522ee87ed4..4586b3f01675 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -134,12 +134,10 @@ MacroAssemblerX64::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerX64::passABIArg(const MoveOperand &from)
 {
     MoveOperand to;
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE: {
+    if (from.isDouble()) {
         FloatRegister dest;
         if (GetFloatArgReg(passedIntArgs_, passedFloatArgs_++, &dest)) {
             if (from.isFloatReg() && from.floatReg() == dest) {
@@ -149,15 +147,10 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
             to = MoveOperand(dest);
         } else {
             to = MoveOperand(StackPointer, stackForCall_);
-            switch (kind) {
-              case MoveOp::FLOAT32: stackForCall_ += sizeof(float);  break;
-              case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
-              default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument kind");
-            }
+            stackForCall_ += sizeof(double);
         }
-        break;
-      }
-      case MoveOp::GENERAL: {
+        enoughMemory_ = moveResolver_.addMove(from, to, Move::DOUBLE);
+    } else {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
             if (from.isGeneralReg() && from.reg() == dest) {
@@ -169,25 +162,20 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        break;
-      }
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+        enoughMemory_ = moveResolver_.addMove(from, to, Move::GENERAL);
     }
-
-    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 void
 MacroAssemblerX64::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
+    passABIArg(MoveOperand(reg));
 }
 
 void
-MacroAssemblerX64::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
+MacroAssemblerX64::passABIArg(const FloatRegister &reg)
 {
-    passABIArg(MoveOperand(reg), kind);
+    passABIArg(MoveOperand(reg));
 }
 
 void
@@ -231,7 +219,7 @@ MacroAssemblerX64::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
+MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, Result result)
 {
     freeStack(stackAdjust);
     if (dynamicAlignment_)
@@ -242,7 +230,7 @@ MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX64::callWithABI(void *fun, MoveOp::Kind result)
+MacroAssemblerX64::callWithABI(void *fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -251,7 +239,7 @@ MacroAssemblerX64::callWithABI(void *fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
+MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -271,12 +259,12 @@ IsIntArgReg(Register reg)
 }
 
 void
-MacroAssemblerX64::callWithABI(Address fun, MoveOp::Kind result)
+MacroAssemblerX64::callWithABI(Address fun, Result result)
 {
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
         // r10, a volatile, non-argument register.
-        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), MoveOp::GENERAL);
+        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), Move::GENERAL);
         fun.base = r10;
     }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index d8bd8b36d077..fc68f4ad9601 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -79,6 +79,15 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
+    enum Result {
+        GENERAL,
+        DOUBLE,
+        FLOAT
+    };
+
+    typedef MoveResolver::MoveOperand MoveOperand;
+    typedef MoveResolver::Move Move;
+
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
@@ -1193,19 +1202,19 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
+    void passABIArg(const MoveOperand &from);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
+    void passABIArg(const FloatRegister &reg);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
+    void callWithABIPost(uint32_t stackAdjust, Result result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(Address fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(void *fun, Result result = GENERAL);
+    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
+    void callWithABI(Address fun, Result result = GENERAL);
 
     void handleFailureWithHandler(void *handler);
     void handleFailureWithHandlerTail();
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 0ebc99a01326..d41d42bea39d 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -503,6 +503,8 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
@@ -586,24 +588,25 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-        MoveOperand from;
-        switch (f.argProperties(explicitArg)) {
-          case VMFunction::WordByValue:
-            if (f.argPassedInFloatReg(explicitArg))
-                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
-            else
-                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
-                            MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::DoubleByValue:
-          case VMFunction::DoubleByRef:
-            MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
+    if (f.explicitArgs) {
+        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+            MoveOperand from;
+            switch (f.argProperties(explicitArg)) {
+              case VMFunction::WordByValue:
+                if (f.argPassedInFloatReg(explicitArg))
+                    masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
+                else
+                    masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::WordByRef:
+                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::DoubleByValue:
+              case VMFunction::DoubleByRef:
+                MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
+            }
         }
     }
 
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 48914c71a1fd..534518ff2eaa 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -900,7 +900,7 @@ CodeGeneratorX86::visitOutOfLineTruncate(OutOfLineTruncate *ool)
         saveVolatile(output);
 
         masm.setupUnalignedABICall(1, output);
-        masm.passABIArg(input, MoveOp::DOUBLE);
+        masm.passABIArg(input);
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
         else
@@ -991,7 +991,7 @@ CodeGeneratorX86::visitOutOfLineTruncateFloat32(OutOfLineTruncateFloat32 *ool)
         masm.push(input);
         masm.setupUnalignedABICall(1, output);
         masm.cvtss2sd(input, input);
-        masm.passABIArg(input, MoveOp::DOUBLE);
+        masm.passABIArg(input);
 
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index a4b00cdc27fb..ace3e98d36af 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -163,29 +163,29 @@ MacroAssemblerX86::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerX86::passABIArg(const MoveOperand &from)
 {
     ++passedArgs_;
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
-    switch (kind) {
-      case MoveOp::FLOAT32: stackForCall_ += sizeof(float); break;
-      case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
-      case MoveOp::GENERAL: stackForCall_ += sizeof(int32_t); break;
-      default: MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+    if (from.isDouble()) {
+        stackForCall_ += sizeof(double);
+        enoughMemory_ &= moveResolver_.addMove(from, to, Move::DOUBLE);
+    } else {
+        stackForCall_ += sizeof(int32_t);
+        enoughMemory_ &= moveResolver_.addMove(from, to, Move::GENERAL);
     }
-    enoughMemory_ &= moveResolver_.addMove(from, to, kind);
 }
 
 void
 MacroAssemblerX86::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
+    passABIArg(MoveOperand(reg));
 }
 
 void
-MacroAssemblerX86::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
+MacroAssemblerX86::passABIArg(const FloatRegister &reg)
 {
-    passABIArg(MoveOperand(reg), kind);
+    passABIArg(MoveOperand(reg));
 }
 
 void
@@ -230,15 +230,16 @@ MacroAssemblerX86::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
+MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, Result result)
 {
     freeStack(stackAdjust);
-    if (result == MoveOp::DOUBLE) {
+    if (result == DOUBLE) {
         reserveStack(sizeof(double));
         fstp(Operand(esp, 0));
         loadDouble(Operand(esp, 0), ReturnFloatReg);
         freeStack(sizeof(double));
-    } else if (result == MoveOp::FLOAT32) {
+    }
+    if (result == FLOAT) {
         reserveStack(sizeof(float));
         fstp32(Operand(esp, 0));
         loadFloat(Operand(esp, 0), ReturnFloatReg);
@@ -252,7 +253,7 @@ MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX86::callWithABI(void *fun, MoveOp::Kind result)
+MacroAssemblerX86::callWithABI(void *fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -261,7 +262,7 @@ MacroAssemblerX86::callWithABI(void *fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, MoveOp::Kind result)
+MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -270,7 +271,7 @@ MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX86::callWithABI(const Address &fun, MoveOp::Kind result)
+MacroAssemblerX86::callWithABI(const Address &fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index eb4a64cb8ae7..0d1395a08300 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -70,6 +70,15 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
+    enum Result {
+        GENERAL,
+        DOUBLE,
+        FLOAT
+    };
+
+    typedef MoveResolver::MoveOperand MoveOperand;
+    typedef MoveResolver::Move Move;
+
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
@@ -1037,19 +1046,19 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
+    void passABIArg(const MoveOperand &from);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
+    void passABIArg(const FloatRegister &reg);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
+    void callWithABIPost(uint32_t stackAdjust, Result result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(AsmJSImmPtr fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(void *fun, Result result = GENERAL);
+    void callWithABI(AsmJSImmPtr fun, Result result = GENERAL);
+    void callWithABI(const Address &fun, Result result = GENERAL);
 
     // Used from within an Exit frame to handle a pending exception.
     void handleFailureWithHandler(void *handler);
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 6b584b6cbfc1..a14d8e2c2dfc 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -538,6 +538,8 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
@@ -614,31 +616,31 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-        MoveOperand from;
-        switch (f.argProperties(explicitArg)) {
-          case VMFunction::WordByValue:
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::DoubleByValue:
-            // We don't pass doubles in float registers on x86, so no need
-            // to check for argPassedInFloatReg.
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
-                            MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::DoubleByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
-                            MoveOp::GENERAL);
-            argDisp += 2 * sizeof(void *);
-            break;
+    if (f.explicitArgs) {
+        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+            MoveOperand from;
+            switch (f.argProperties(explicitArg)) {
+              case VMFunction::WordByValue:
+                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::DoubleByValue:
+                // We don't pass doubles in float registers on x86, so no need
+                // to check for argPassedInFloatReg.
+                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::WordByRef:
+                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::DoubleByRef:
+                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+                argDisp += 2 * sizeof(void *);
+                break;
+            }
         }
     }
 

From c73a917e235fcda42aba7028110f562416205ede Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabrice=20Desr=C3=A9?= <fabrice@mozilla.com>
Date: Fri, 13 Dec 2013 10:38:38 -0800
Subject: [PATCH 143/144] Bug 949191 - [B2G][Browser] unknown cert issuer error
 message text overlaps the border and the text's letters are too small to read
 it r=gwagner

---
 b2g/chrome/content/netError.css | 131 ++++++++++++++++++++++++++++++++
 b2g/chrome/jar.mn               |   2 +
 2 files changed, 133 insertions(+)
 create mode 100644 b2g/chrome/content/netError.css

diff --git a/b2g/chrome/content/netError.css b/b2g/chrome/content/netError.css
new file mode 100644
index 000000000000..f83ded7d4f35
--- /dev/null
+++ b/b2g/chrome/content/netError.css
@@ -0,0 +1,131 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ *  This defines the look-and-feel styling of the error pages.
+ *  (see: netError.xhtml)
+ *
+ *  Original styling by William Price <bugzilla@mob.rice.edu>
+ *  Updated for mobile by: Wes Johnston <wjohnston@mozilla.com>
+ */
+
+body {
+  margin: 0;
+  padding: 0 8px 8px;
+  font-family: "Nokia Sans", Tahoma, sans-serif !important;
+}
+
+h1 {
+  font-size: 22px;
+}
+
+h2 {
+  font-size: 16px;
+}
+
+ul {
+  margin: 0px;
+  padding: 0px 0px 0px 1em;
+}
+
+li {
+  margin: 0px;
+  padding: 8px 0px;
+}
+
+#errorPage {
+  background-color: #CEE6F4;
+}
+
+#errorPage.certerror {
+  background-color: #EFD400;
+}
+
+#errorPage.blockedsite {
+  background-color: #BF0000;
+}
+
+#errorTitle {
+  background: url("chrome://browser/content/images/errorpage-warning.png") left center no-repeat;
+  /* Scaled by .666 of their actual size */
+  background-size: 40px 40px;
+  background-origin: content-box;
+  min-height: 60px;
+  margin-left: auto;
+  margin-right: auto;
+  max-width: 500px;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+#errorPage.certerror #errorTitle {
+  background-image: url("chrome://browser/content/images/errorpage-larry-black.png");
+}
+
+#errorPage.blockedsite #errorTitle {
+  background-image: url("chrome://browser/content/images/errorpage-larry-white.png");
+  color: white;
+}
+
+.errorTitleText {
+  padding: 0px 0px 0px 50px;
+  display: inline-block;
+  vertical-align: middle
+}
+
+#errorPageContainer {
+  background-color: white;
+  border: 1px solid #999999;
+  border-radius: 6px;
+  padding: 6px 20px 20px;
+  font-size: 14px;
+  max-width: 500px;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+#errorShortDesc > p:empty {
+  display: none;
+}
+
+#errorShortDesc > p {
+  overflow: auto;
+  border-bottom: 1px solid #999999;
+  padding-bottom: 1em;
+}
+
+#errorPage.blockedsite #errorShortDesc > p {
+  font-weight: bold;
+  border-bottom: none;
+  padding-bottom: 0px;
+}
+
+#securityOverrideDiv {
+  padding-top: 10px;
+}
+
+div[collapsed] {
+  padding-left: 15px;
+  background-image: url("chrome://browser/skin/images/arrowright-16.png");
+  background-size: 11px 11px;
+  background-repeat: no-repeat;
+  background-position: left 0.3em;
+}
+
+div[collapsed="true"] {
+  background-image: url("chrome://browser/skin/images/arrowright-16.png");
+}
+
+div[collapsed="false"] {
+  background-image: url("chrome://browser/skin/images/arrowdown-16.png");
+}
+
+div[collapsed="true"] > p,
+div[collapsed="true"] > div {
+  display: none;
+}
+
+button {
+  padding: 0.3em !important;
+}
diff --git a/b2g/chrome/jar.mn b/b2g/chrome/jar.mn
index c8c344be72d8..632668d3f085 100644
--- a/b2g/chrome/jar.mn
+++ b/b2g/chrome/jar.mn
@@ -25,9 +25,11 @@ chrome.jar:
 
 % override chrome://global/skin/media/videocontrols.css chrome://browser/content/touchcontrols.css
 % override chrome://global/content/aboutCertError.xhtml chrome://browser/content/aboutCertError.xhtml
+% override chrome://global/skin/netError.css chrome://browser/content/netError.css
 
   content/ErrorPage.js                  (content/ErrorPage.js)
   content/aboutCertError.xhtml          (content/aboutCertError.xhtml)
+  content/netError.css                  (content/netError.css)
   content/images/errorpage-larry-black.png (content/images/errorpage-larry-black.png)
   content/images/errorpage-larry-white.png (content/images/errorpage-larry-white.png)
   content/images/errorpage-warning.png (content/images/errorpage-warning.png)

From ef86288f4aadcaf3171f7147ec42ddaaa9e8d788 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 10:45:24 -0800
Subject: [PATCH 144/144] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/62c0ad5b88f1
Author: James Lal <james@lightsofapollo.com>
Desc: Merge pull request #14519 from lightsofapollo/s3-uploads

Bug 948177 - Setup Travis S3 bucket / artifact configuration +shepherd

========

https://hg.mozilla.org/integration/gaia-central/rev/a0b719d1599c
Author: James Lal <james@lightsofapollo.com>
Desc: Bug 948177 - Setup Travis S3 bucket / artifact configuration
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 2ef805efe0f0..c14c25b2ebc6 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "2b63513acfbf8b2c8e55465cb209c2ace9db05b0", 
+    "revision": "62c0ad5b88f15d5da1cc2496b9534087dbc5d015", 
     "repo_path": "/integration/gaia-central"
 }