Merge inbound to mozilla-central. a=merge

browser/base/content/browser-places.js

@@ -1289,17 +1289,6 @@ var BookmarkingUI = {
     return gNavigatorBundle.getFormattedString(strId, args);
   },
 
-  /**
-   * The popup contents must be updated when the user customizes the UI, or
-   * changes the personal toolbar collapsed status.  In such a case, any needed
-   * change should be handled in the popupshowing helper, for performance
-   * reasons.
-   */
-  _popupNeedsUpdate: true,
-  onToolbarVisibilityChange: function BUI_onToolbarVisibilityChange() {
-    this._popupNeedsUpdate = true;
-  },
-
   onPopupShowing: function BUI_onPopupShowing(event) {
     // Don't handle events for submenus.
     if (event.target != event.currentTarget)
@@ -1331,23 +1320,21 @@ var BookmarkingUI = {
 
     this._initMobileBookmarks(document.getElementById("BMB_mobileBookmarks"));
 
-    if (!this._popupNeedsUpdate)
-      return;
-    this._popupNeedsUpdate = false;
+    this.selectLabel("BMB_viewBookmarksSidebar",
+                     SidebarUI.currentID == "viewBookmarksSidebar");
+    this.selectLabel("BMB_viewBookmarksToolbar",
+                     !document.getElementById("PersonalToolbar").collapsed);
+  },
 
-    let popup = event.target;
-    let getPlacesAnonymousElement =
-      aAnonId => document.getAnonymousElementByAttribute(popup.parentNode,
-                                                         "placesanonid",
-                                                         aAnonId);
+  selectLabel(elementId, visible) {
+    let element = document.getElementById(elementId);
+    element.setAttribute("label", element.getAttribute(visible ? "label-hide"
+                                                               : "label-show"));
+  },
 
-    let viewToolbarMenuitem = getPlacesAnonymousElement("view-toolbar");
-    if (viewToolbarMenuitem) {
-      // Update View bookmarks toolbar checkbox menuitem.
-      viewToolbarMenuitem.classList.add("subviewbutton");
-      let personalToolbar = document.getElementById("PersonalToolbar");
-      viewToolbarMenuitem.setAttribute("checked", !personalToolbar.collapsed);
-    }
+  toggleBookmarksToolbar() {
+    CustomizableUI.setToolbarVisibility("PersonalToolbar",
+      document.getElementById("PersonalToolbar").collapsed);
   },
 
   attachPlacesView(event, node) {
@@ -1440,7 +1427,6 @@ var BookmarkingUI = {
   onCustomizeEnd: function BUI_customizeEnd(aWindow) {
     if (aWindow == window) {
       this._isCustomizing = false;
-      this.onToolbarVisibilityChange();
     }
   },
 
@@ -1651,40 +1637,14 @@ var BookmarkingUI = {
   },
 
   showBookmarkingTools(triggerNode) {
-    const panelID = "PanelUI-bookmarkingTools";
-    let viewNode = document.getElementById(panelID);
-    for (let button of [...viewNode.getElementsByTagName("toolbarbutton")]) {
-      let update = true;
-      switch (button.id) {
-        case "panelMenu_toggleBookmarksMenu":
-          let placement = CustomizableUI.getPlacementOfWidget(this.BOOKMARK_BUTTON_ID);
-          button.setAttribute("checked", !!placement && placement.area == CustomizableUI.AREA_NAVBAR);
-          break;
-        case "panelMenu_viewBookmarksSidebar":
-          button.setAttribute("checked", SidebarUI.currentID == "viewBookmarksSidebar");
-          break;
-        case "panelMenu_viewBookmarksToolbar":
-          let toolbar = document.getElementById("PersonalToolbar");
-          // This is an actual toolbarbutton[type=checkbox], and its checked
-          // attribute will get added/removed by the binding when clicked.
-          // Setting the attribute to 'false' breaks showing the toolbar,
-          // because the binding removes the attribute instead of setting it
-          // to 'true' when clicked.
-          if (toolbar.getAttribute("collapsed") != "true") {
-            button.setAttribute("checked", "true");
-          } else {
-            button.removeAttribute("checked");
-          }
-          break;
-        default:
-          update = false;
-          break;
-      }
-      if (update) {
-        updateToggleControlLabel(button);
-      }
-    }
-    PanelUI.showSubView(panelID, triggerNode);
+    let placement = CustomizableUI.getPlacementOfWidget(this.BOOKMARK_BUTTON_ID);
+    this.selectLabel("panelMenu_toggleBookmarksMenu",
+                     placement && placement.area == CustomizableUI.AREA_NAVBAR);
+    this.selectLabel("panelMenu_viewBookmarksSidebar",
+                     SidebarUI.currentID == "viewBookmarksSidebar");
+    this.selectLabel("panelMenu_viewBookmarksToolbar",
+                     !document.getElementById("PersonalToolbar").collapsed);
+    PanelUI.showSubView("PanelUI-bookmarkingTools", triggerNode);
   },
 
   toggleMenuButtonInToolbar(triggerNode) {

browser/base/content/browser.js

@@ -5605,8 +5605,6 @@ function setToolbarVisibility(toolbar, isVisible, persist = true) {
   let event = new CustomEvent("toolbarvisibilitychange", eventParams);
   toolbar.dispatchEvent(event);
 
-  BookmarkingUI.onToolbarVisibilityChange();
-
   if (toolbar.getAttribute("type") == "menubar" && CustomizationHandler.isCustomizing()) {
     gCustomizeMode._updateDragSpaceCheckbox();
   }

browser/base/content/browser.xul

@@ -1110,11 +1110,9 @@
                    tooltip="bhTooltip" popupsinherittooltip="true">
           <menuitem id="BMB_viewBookmarksSidebar"
                     class="subviewbutton"
-                    label="&viewBookmarksSidebar2.label;"
-                    type="checkbox"
-                    oncommand="SidebarUI.toggle('viewBookmarksSidebar');">
-            <observes element="viewBookmarksSidebar" attribute="checked"/>
-          </menuitem>
+                    label-show="&viewBookmarksSidebar2.label;"
+                    label-hide="&hideBookmarksSidebar.label;"
+                    oncommand="SidebarUI.toggle('viewBookmarksSidebar');"/>
           <!-- NB: temporary solution for bug 985024, this should go away soon. -->
           <menuitem id="BMB_bookmarksShowAllTop"
                     class="menuitem-iconic subviewbutton"
@@ -1133,11 +1131,10 @@
                                          new PlacesMenu(event, 'place:folder=TOOLBAR',
                                                         PlacesUIUtils.getViewForNode(this.parentNode.parentNode).options);">
               <menuitem id="BMB_viewBookmarksToolbar"
-                        placesanonid="view-toolbar"
-                        toolbarId="PersonalToolbar"
-                        type="checkbox"
-                        oncommand="onViewToolbarCommand(event)"
-                        label="&viewBookmarksToolbar.label;"/>
+                        class="subviewbutton"
+                        label-show="&viewBookmarksToolbar.label;"
+                        label-hide="&hideBookmarksToolbar.label;"
+                        oncommand="BookmarkingUI.toggleBookmarksToolbar();"/>
               <menuseparator/>
               <!-- Bookmarks toolbar items -->
             </menupopup>

browser/components/customizableui/content/panelUI.inc.xul

@@ -660,26 +660,21 @@
     <panelview id="PanelUI-bookmarkingTools" class="PanelUI-subView">
       <vbox class="panel-subview-body">
         <toolbarbutton id="panelMenu_toggleBookmarksMenu"
-                       label="&addBookmarksMenu.label;"
-                       label-checked="&removeBookmarksMenu.label;"
                        class="subviewbutton subviewbutton-iconic"
-                       oncommand="BookmarkingUI.toggleMenuButtonInToolbar(this); PanelUI.hide();"/>
+                       label-show="&addBookmarksMenu.label;"
+                       label-hide="&removeBookmarksMenu.label;"
+                       oncommand="BookmarkingUI.toggleMenuButtonInToolbar(this);"/>
         <toolbarbutton id="panelMenu_viewBookmarksSidebar"
-                       label="&viewBookmarksSidebar2.label;"
-                       label-checked="&hideBookmarksSidebar.label;"
                        class="subviewbutton subviewbutton-iconic"
+                       label-show="&viewBookmarksSidebar2.label;"
+                       label-hide="&hideBookmarksSidebar.label;"
                        key="viewBookmarksSidebarKb"
-                       oncommand="SidebarUI.toggle('viewBookmarksSidebar', this); PanelUI.hide();">
-          <observes element="viewBookmarksSidebar" attribute="checked"/>
-        </toolbarbutton>
+                       oncommand="SidebarUI.toggle('viewBookmarksSidebar', this);"/>
         <toolbarbutton id="panelMenu_viewBookmarksToolbar"
                        class="subviewbutton subviewbutton-iconic"
-                       placesanonid="view-toolbar"
-                       toolbarId="PersonalToolbar"
-                       type="checkbox"
-                       oncommand="onViewToolbarCommand(event)"
-                       label="&viewBookmarksToolbar.label;"
-                       label-checked="&hideBookmarksToolbar.label;"/>
+                       label-show="&viewBookmarksToolbar.label;"
+                       label-hide="&hideBookmarksToolbar.label;"
+                       oncommand="BookmarkingUI.toggleBookmarksToolbar();"/>
       </vbox>
     </panelview>
   </panelmultiview>

browser/themes/shared/customizableui/panelUI.inc.css

@@ -863,7 +863,7 @@ panelview .toolbarbutton-1,
 .subviewbutton[shortcut]::after {
   content: attr(shortcut);
   float: right;
-  color: GrayText;
+  opacity: 0.5;
 }
 
 .PanelUI-subView .subviewbutton-nav::after {

dom/media/MediaData.cpp

@@ -501,10 +501,11 @@ MediaRawData::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const
   return size;
 }
 
-MediaRawDataWriter*
+UniquePtr<MediaRawDataWriter>
 MediaRawData::CreateWriter()
 {
-  return new MediaRawDataWriter(this);
+  UniquePtr<MediaRawDataWriter> p(new MediaRawDataWriter(this));
+  return p;
 }
 
 MediaRawDataWriter::MediaRawDataWriter(MediaRawData* aMediaRawData)

dom/media/MediaData.h

@@ -701,9 +701,9 @@ public:
 
   // Return a deep copy or nullptr if out of memory.
   virtual already_AddRefed<MediaRawData> Clone() const;
-  // Create a MediaRawDataWriter for this MediaRawData. The caller must
-  // delete the writer once done. The writer is not thread-safe.
-  virtual MediaRawDataWriter* CreateWriter();
+  // Create a MediaRawDataWriter for this MediaRawData. The writer is not
+  // thread-safe.
+  virtual UniquePtr<MediaRawDataWriter> CreateWriter();
   virtual size_t SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const;
 
 protected:

dom/media/flac/FlacDemuxer.cpp

@@ -8,7 +8,6 @@
 
 #include "mozilla/Maybe.h"
 #include "BitReader.h"
-#include "nsAutoPtr.h"
 #include "prenv.h"
 #include "FlacFrameParser.h"
 #include "VideoUtils.h"
@@ -963,7 +962,7 @@ FlacTrackDemuxer::GetNextFrame(const flac::Frame& aFrame)
   RefPtr<MediaRawData> frame = new MediaRawData();
   frame->mOffset = offset;
 
-  nsAutoPtr<MediaRawDataWriter> frameWriter(frame->CreateWriter());
+  UniquePtr<MediaRawDataWriter> frameWriter(frame->CreateWriter());
   if (!frameWriter->SetSize(size)) {
     LOG("GetNext() Exit failed to allocated media buffer");
     return nullptr;

dom/media/mp3/MP3Demuxer.cpp

@@ -11,7 +11,6 @@
 #include <limits>
 
 #include "mozilla/Assertions.h"
-#include "nsAutoPtr.h"
 #include "TimeUnits.h"
 #include "VideoUtils.h"
 
@@ -644,7 +643,7 @@ MP3TrackDemuxer::GetNextFrame(const MediaByteRange& aRange)
   RefPtr<MediaRawData> frame = new MediaRawData();
   frame->mOffset = aRange.mStart;
 
-  nsAutoPtr<MediaRawDataWriter> frameWriter(frame->CreateWriter());
+  UniquePtr<MediaRawDataWriter> frameWriter(frame->CreateWriter());
   if (!frameWriter->SetSize(aRange.Length())) {
     MP3LOG("GetNext() Exit failed to allocated media buffer");
     return nullptr;

dom/media/mp4/Index.cpp

@@ -110,7 +110,7 @@ already_AddRefed<MediaRawData> SampleIterator::GetNext()
   sample->mOffset = s->mByteRange.mStart;
   sample->mKeyframe = s->mSync;
 
-  nsAutoPtr<MediaRawDataWriter> writer(sample->CreateWriter());
+  UniquePtr<MediaRawDataWriter> writer(sample->CreateWriter());
   // Do the blocking read
   if (!writer->SetSize(s->mByteRange.Length())) {
     return nullptr;

dom/media/mp4/MP4Demuxer.cpp

@@ -500,7 +500,7 @@ MP4TrackDemuxer::GetNextSample()
   }
 
   if (sample->mCrypto.mValid) {
-    nsAutoPtr<MediaRawDataWriter> writer(sample->CreateWriter());
+    UniquePtr<MediaRawDataWriter> writer(sample->CreateWriter());
     writer->mCrypto.mMode = mInfo->mCrypto.mMode;
 
     // Only use the default key parsed from the moov if we haven't already got

dom/media/platforms/agnostic/bytestreams/Adts.cpp

@@ -6,7 +6,6 @@
 #include "MediaData.h"
 #include "mozilla/Array.h"
 #include "mozilla/ArrayUtils.h"
-#include "nsAutoPtr.h"
 
 namespace mozilla
 {
@@ -56,7 +55,7 @@ Adts::ConvertSample(uint16_t aChannelCount,
   header[5] = ((newSize & 7) << 5) + 0x1f;
   header[6] = 0xfc;
 
-  nsAutoPtr<MediaRawDataWriter> writer(aSample->CreateWriter());
+  UniquePtr<MediaRawDataWriter> writer(aSample->CreateWriter());
   if (!writer->Prepend(&header[0], ArrayLength(header))) {
     return false;
   }
@@ -88,7 +87,7 @@ Adts::RevertSample(MediaRawData* aSample)
     }
   }
 
-  nsAutoPtr<MediaRawDataWriter> writer(aSample->CreateWriter());
+  UniquePtr<MediaRawDataWriter> writer(aSample->CreateWriter());
   writer->PopFront(kADTSHeaderSize);
 
   if (aSample->mCrypto.mValid) {

dom/media/platforms/agnostic/bytestreams/AnnexB.cpp

@@ -10,7 +10,6 @@
 #include "BufferReader.h"
 #include "ByteWriter.h"
 #include "MediaData.h"
-#include "nsAutoPtr.h"
 
 namespace mozilla
 {
@@ -55,7 +54,7 @@ AnnexB::ConvertSampleToAnnexB(mozilla::MediaRawData* aSample, bool aAddSPS)
     }
   }
 
-  nsAutoPtr<MediaRawDataWriter> samplewriter(aSample->CreateWriter());
+  UniquePtr<MediaRawDataWriter> samplewriter(aSample->CreateWriter());
 
   if (!samplewriter->Replace(tmp.Elements(), tmp.Length())) {
     return Err(NS_ERROR_OUT_OF_MEMORY);
@@ -254,7 +253,7 @@ AnnexB::ConvertSampleToAVCC(mozilla::MediaRawData* aSample)
   if (ParseNALUnits(writer, reader).isErr()) {
     return false;
   }
-  nsAutoPtr<MediaRawDataWriter> samplewriter(aSample->CreateWriter());
+  UniquePtr<MediaRawDataWriter> samplewriter(aSample->CreateWriter());
   if (!samplewriter->Replace(nalu.Elements(), nalu.Length())) {
     return false;
   }
@@ -308,7 +307,7 @@ AnnexB::ConvertSampleTo4BytesAVCC(mozilla::MediaRawData* aSample)
       return Err(NS_ERROR_OUT_OF_MEMORY);
     }
   }
-  nsAutoPtr<MediaRawDataWriter> samplewriter(aSample->CreateWriter());
+  UniquePtr<MediaRawDataWriter> samplewriter(aSample->CreateWriter());
   if (!samplewriter->Replace(dest.Elements(), dest.Length())) {
     return Err(NS_ERROR_OUT_OF_MEMORY);
   }

dom/media/wave/WaveDemuxer.cpp

@@ -12,7 +12,6 @@
 #include "mozilla/Assertions.h"
 #include "mozilla/EndianUtils.h"
 #include "BufferReader.h"
-#include "nsAutoPtr.h"
 #include "VideoUtils.h"
 #include "TimeUnits.h"
 
@@ -515,7 +514,7 @@ WAVTrackDemuxer::GetNextChunk(const MediaByteRange& aRange)
   RefPtr<MediaRawData> datachunk = new MediaRawData();
   datachunk->mOffset = aRange.mStart;
 
-  nsAutoPtr<MediaRawDataWriter> chunkWriter(datachunk->CreateWriter());
+  UniquePtr<MediaRawDataWriter> chunkWriter(datachunk->CreateWriter());
   if (!chunkWriter->SetSize(aRange.Length())) {
     return nullptr;
   }
@@ -559,7 +558,7 @@ WAVTrackDemuxer::GetFileHeader(const MediaByteRange& aRange)
   RefPtr<MediaRawData> fileHeader = new MediaRawData();
   fileHeader->mOffset = aRange.mStart;
 
-  nsAutoPtr<MediaRawDataWriter> headerWriter(fileHeader->CreateWriter());
+  UniquePtr<MediaRawDataWriter> headerWriter(fileHeader->CreateWriter());
   if (!headerWriter->SetSize(aRange.Length())) {
     return nullptr;
   }

dom/media/webm/WebMDemuxer.cpp

@@ -19,7 +19,6 @@
 #include "mozilla/EndianUtils.h"
 #include "mozilla/SharedThreadPool.h"
 #include "MediaDataDemuxer.h"
-#include "nsAutoPtr.h"
 #include "nsAutoRef.h"
 #include "NesteggPacketHolder.h"
 #include "XiphExtradata.h"
@@ -781,7 +780,7 @@ WebMDemuxer::GetNextPacket(TrackInfo::TrackType aType,
     if (packetEncryption == NESTEGG_PACKET_HAS_SIGNAL_BYTE_UNENCRYPTED ||
         packetEncryption == NESTEGG_PACKET_HAS_SIGNAL_BYTE_ENCRYPTED ||
         packetEncryption == NESTEGG_PACKET_HAS_SIGNAL_BYTE_PARTITIONED) {
-      nsAutoPtr<MediaRawDataWriter> writer(sample->CreateWriter());
+      UniquePtr<MediaRawDataWriter> writer(sample->CreateWriter());
       unsigned char const* iv;
       size_t ivLength;
       nestegg_packet_iv(holder->Packet(), &iv, &ivLength);
@@ -1272,7 +1271,7 @@ WebMTrackDemuxer::UpdateSamples(nsTArray<RefPtr<MediaRawData>>& aSamples)
 {
   for (const auto& sample : aSamples) {
     if (sample->mCrypto.mValid) {
-      nsAutoPtr<MediaRawDataWriter> writer(sample->CreateWriter());
+      UniquePtr<MediaRawDataWriter> writer(sample->CreateWriter());
       writer->mCrypto.mMode = mInfo->mCrypto.mMode;
       writer->mCrypto.mIVSize = mInfo->mCrypto.mIVSize;
       writer->mCrypto.mKeyId.AppendElements(mInfo->mCrypto.mKeyId);

js/src/builtin/DataViewObject.cpp

@@ -92,7 +92,7 @@ DataViewObject::create(JSContext* cx, uint32_t byteOffset, uint32_t byteLength,
             MOZ_ASSERT(arrayBuffer->byteLength() == 0 &&
                        (uintptr_t(ptr.unwrapValue()) & gc::ChunkMask) == 0);
         } else {
-            cx->zone()->group()->storeBuffer().putWholeCell(obj);
+            cx->runtime()->gc.storeBuffer().putWholeCell(obj);
         }
     }
 

js/src/builtin/MapObject.cpp

@@ -266,7 +266,7 @@ MapIteratorObject::finalize(FreeOp* fop, JSObject* obj)
     MOZ_ASSERT(!IsInsideNursery(obj));
 
     auto range = MapIteratorObjectRange(&obj->as<NativeObject>());
-    MOZ_ASSERT(!obj->zone()->group()->nursery().isInside(range));
+    MOZ_ASSERT(!fop->runtime()->gc.nursery().isInside(range));
 
     fop->delete_(range);
 }
@@ -282,7 +282,7 @@ MapIteratorObject::objectMoved(JSObject* obj, JSObject* old)
     if (!range)
         return 0;
 
-    Nursery& nursery = iter->zone()->group()->nursery();
+    Nursery& nursery = iter->runtimeFromActiveCooperatingThread()->gc.nursery();
     if (!nursery.isInside(range)) {
         nursery.removeMallocedBuffer(range);
         return 0;
@@ -567,7 +567,8 @@ WriteBarrierPostImpl(ObjectT* obj, const Value& keyValue)
         if (!keys)
             return false;
 
-        key->zone()->group()->storeBuffer().putGeneric(OrderedHashTableRef<ObjectT>(obj));
+        JSRuntime* rt = key->runtimeFromActiveCooperatingThread();
+        rt->gc.storeBuffer().putGeneric(OrderedHashTableRef<ObjectT>(obj));
     }
 
     if (!keys->append(key))
@@ -1116,7 +1117,7 @@ SetIteratorObject::finalize(FreeOp* fop, JSObject* obj)
     MOZ_ASSERT(!IsInsideNursery(obj));
 
     auto range = SetIteratorObjectRange(&obj->as<NativeObject>());
-    MOZ_ASSERT(!obj->zone()->group()->nursery().isInside(range));
+    MOZ_ASSERT(!fop->runtime()->gc.nursery().isInside(range));
 
     fop->delete_(range);
 }
@@ -1132,7 +1133,7 @@ SetIteratorObject::objectMoved(JSObject* obj, JSObject* old)
     if (!range)
         return 0;
 
-    Nursery& nursery = iter->zone()->group()->nursery();
+    Nursery& nursery = iter->runtimeFromActiveCooperatingThread()->gc.nursery();
     if (!nursery.isInside(range)) {
         nursery.removeMallocedBuffer(range);
         return 0;

js/src/builtin/TestingFunctions.cpp

@@ -352,7 +352,7 @@ MinorGC(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.get(0) == BooleanValue(true))
-        cx->zone()->group()->storeBuffer().setAboutToOverflow(JS::gcreason::FULL_GENERIC_BUFFER);
+        cx->runtime()->gc.storeBuffer().setAboutToOverflow(JS::gcreason::FULL_GENERIC_BUFFER);
 
     cx->minorGC(JS::gcreason::API);
     args.rval().setUndefined();
@@ -2539,7 +2539,8 @@ testingFunc_bailAfter(JSContext* cx, unsigned argc, Value* vp)
     }
 
 #ifdef DEBUG
-    cx->zone()->group()->setIonBailAfter(args[0].toInt32());
+    if (auto* jitRuntime = cx->runtime()->jitRuntime())
+        jitRuntime->setIonBailAfter(args[0].toInt32());
 #endif
 
     args.rval().setUndefined();

js/src/builtin/TypedObject.cpp

@@ -1434,7 +1434,7 @@ OutlineTypedObject::setOwnerAndData(JSObject* owner, uint8_t* data)
     // Trigger a post barrier when attaching an object outside the nursery to
     // one that is inside it.
     if (owner && !IsInsideNursery(this) && IsInsideNursery(owner))
-        zone()->group()->storeBuffer().putWholeCell(this);
+        owner->storeBuffer()->putWholeCell(this);
 }
 
 /*static*/ OutlineTypedObject*
@@ -1634,7 +1634,7 @@ OutlineTypedObject::obj_trace(JSTracer* trc, JSObject* object)
         typedObj.setData(newData);
 
         if (trc->isTenuringTracer()) {
-            Nursery& nursery = typedObj.zoneFromAnyThread()->group()->nursery();
+            Nursery& nursery = trc->runtime()->gc.nursery();
             nursery.maybeSetForwardingPointer(trc, oldData, newData, /* direct = */ false);
         }
     }
@@ -2144,7 +2144,7 @@ InlineTypedObject::obj_moved(JSObject* dst, JSObject* src)
         // but they will not set any direct forwarding pointers.
         uint8_t* oldData = reinterpret_cast<uint8_t*>(src) + offsetOfDataStart();
         uint8_t* newData = dst->as<InlineTypedObject>().inlineTypedMem();
-        auto& nursery = dst->zone()->group()->nursery();
+        auto& nursery = dst->runtimeFromActiveCooperatingThread()->gc.nursery();
         bool direct = descr.size() >= sizeof(uintptr_t);
         nursery.setForwardingPointerWhileTenuring(oldData, newData, direct);
     }
@@ -2195,7 +2195,7 @@ InlineTransparentTypedObject::getOrCreateBuffer(JSContext* cx)
     if (IsInsideNursery(this)) {
         // Make sure the buffer is traced by the next generational collection,
         // so that its data pointer is updated after this typed object moves.
-        zone()->group()->storeBuffer().putWholeCell(buffer);
+        storeBuffer()->putWholeCell(buffer);
     }
 
     return buffer;

js/src/gc/GC-inl.h

@@ -207,7 +207,8 @@ class ZoneCellIter<TenuredCell> {
 
     void init(JS::Zone* zone, AllocKind kind) {
         MOZ_ASSERT_IF(IsNurseryAllocable(kind),
-                      zone->isAtomsZone() || zone->group()->nursery().isEmpty());
+                      (zone->isAtomsZone() ||
+                       zone->runtimeFromActiveCooperatingThread()->gc.nursery().isEmpty()));
         initForTenuredIteration(zone, kind);
     }
 

js/src/gc/GC.cpp

@@ -1065,10 +1065,8 @@ GCRuntime::setZeal(uint8_t zeal, uint32_t frequency)
     }
 
     ZealMode zealMode = ZealMode(zeal);
-    if (zealMode == ZealMode::GenerationalGC) {
-        for (ZoneGroupsIter group(rt); !group.done(); group.next())
-            group->nursery().enterZealMode();
-    }
+    if (zealMode == ZealMode::GenerationalGC)
+        nursery().enterZealMode();
 
     // Some modes are mutually exclusive. If we're setting one of those, we
     // first reset all of them.
@@ -1282,8 +1280,7 @@ GCRuntime::finish()
 
     FinishTrace();
 
-    for (ZoneGroupsIter group(rt); !group.done(); group.next())
-        group->nursery().printTotalProfileTimes();
+    nursery().printTotalProfileTimes();
     stats().printTotalProfileTimes();
 }
 
@@ -6609,7 +6606,7 @@ GCRuntime::compactPhase(JS::gcreason::Reason reason, SliceBudget& sliceBudget,
         Zone* zone = zonesToMaybeCompact.ref().front();
         zonesToMaybeCompact.ref().removeFront();
 
-        MOZ_ASSERT(zone->group()->nursery().isEmpty());
+        MOZ_ASSERT(nursery().isEmpty());
         zone->changeGCState(Zone::Finished, Zone::Compact);
 
         if (relocateArenas(zone, reason, relocatedArenas, sliceBudget)) {
@@ -6699,18 +6696,6 @@ HeapStateToLabel(JS::HeapState heapState)
     return nullptr;
 }
 
-#ifdef DEBUG
-static bool
-AllNurseriesAreEmpty(JSRuntime* rt)
-{
-    for (ZoneGroupsIter group(rt); !group.done(); group.next()) {
-        if (!group->nursery().isEmpty())
-            return false;
-    }
-    return true;
-}
-#endif
-
 /* Start a new heap session. */
 AutoTraceSession::AutoTraceSession(JSRuntime* rt, JS::HeapState heapState)
   : runtime(rt),
@@ -6720,7 +6705,7 @@ AutoTraceSession::AutoTraceSession(JSRuntime* rt, JS::HeapState heapState)
 {
     MOZ_ASSERT(prevState == JS::HeapState::Idle);
     MOZ_ASSERT(heapState != JS::HeapState::Idle);
-    MOZ_ASSERT_IF(heapState == JS::HeapState::MajorCollecting, AllNurseriesAreEmpty(rt));
+    MOZ_ASSERT_IF(heapState == JS::HeapState::MajorCollecting, rt->gc.nursery().isEmpty());
 
     // Session always begins with lock held, see comment in class definition.
     maybeLock.emplace(rt);
@@ -7691,8 +7676,7 @@ GCRuntime::onOutOfMallocMemory()
     decommitTask.join();
 
     // Wait for background free of nursery huge slots to finish.
-    for (ZoneGroupsIter group(rt); !group.done(); group.next())
-        group->nursery().waitBackgroundFreeEnd();
+    nursery().waitBackgroundFreeEnd();
 
     AutoLockGC lock(rt);
     onOutOfMallocMemory(lock);
@@ -7756,10 +7740,8 @@ JS::AutoDisableGenerationalGC::AutoDisableGenerationalGC(JSContext* cx)
 
 JS::AutoDisableGenerationalGC::~AutoDisableGenerationalGC()
 {
-    if (--cx->generationalDisabled == 0) {
-        for (ZoneGroupsIter group(cx->runtime()); !group.done(); group.next())
-            group->nursery().enable();
-    }
+    if (--cx->generationalDisabled == 0)
+        cx->nursery().enable();
 }
 
 JS_PUBLIC_API(bool)
@@ -7804,8 +7786,7 @@ js::gc::FinishGC(JSContext* cx)
         JS::FinishIncrementalGC(cx, JS::gcreason::API);
     }
 
-    for (ZoneGroupsIter group(cx->runtime()); !group.done(); group.next())
-        group->nursery().waitBackgroundFreeEnd();
+    cx->nursery().waitBackgroundFreeEnd();
 }
 
 AutoPrepareForTracing::AutoPrepareForTracing(JSContext* cx)
@@ -7858,9 +7839,6 @@ js::NewCompartment(JSContext* cx, JSPrincipals* principals,
             return nullptr;
 
         groupHolder.reset(group);
-
-        if (cx->generationalDisabled)
-            group->nursery().disable();
     }
 
     if (!zone) {
@@ -8942,7 +8920,7 @@ AutoAssertEmptyNursery::checkCondition(JSContext* cx) {
     if (!noAlloc)
         noAlloc.emplace();
     this->cx = cx;
-    MOZ_ASSERT(AllNurseriesAreEmpty(cx->runtime()));
+    MOZ_ASSERT(cx->nursery().isEmpty());
 }
 
 AutoEmptyNursery::AutoEmptyNursery(JSContext* cx)
@@ -8950,7 +8928,7 @@ AutoEmptyNursery::AutoEmptyNursery(JSContext* cx)
 {
     MOZ_ASSERT(!cx->suppressGC);
     cx->runtime()->gc.stats().suspendPhases();
-    EvictAllNurseries(cx->runtime(), JS::gcreason::EVICT_NURSERY);
+    cx->runtime()->gc.evictNursery(JS::gcreason::EVICT_NURSERY);
     cx->runtime()->gc.stats().resumePhases();
     checkCondition(cx);
 }

js/src/gc/Nursery-inl.h

@@ -139,12 +139,6 @@ ReallocateObjectBuffer(JSContext* cx, JSObject* obj, T* oldBuffer,
     return buffer;
 }
 
-static inline void
-EvictAllNurseries(JSRuntime* rt, JS::gcreason::Reason reason = JS::gcreason::EVICT_NURSERY)
-{
-    rt->gc.evictNursery(reason);
-}
-
 } // namespace js
 
 #endif /* gc_Nursery_inl_h */

js/src/gc/RootMarking.cpp

@@ -284,8 +284,8 @@ js::TraceRuntime(JSTracer* trc)
     MOZ_ASSERT(!trc->isMarkingTracer());
 
     JSRuntime* rt = trc->runtime();
-    EvictAllNurseries(rt);
-    AutoPrepareForTracing prep(TlsContext.get());
+    rt->gc.evictNursery();
+    AutoPrepareForTracing prep(rt->mainContextFromOwnThread());
     gcstats::AutoPhase ap(rt->gc.stats(), gcstats::PhaseKind::TRACE_HEAP);
     rt->gc.traceRuntime(trc, prep.session());
 }

js/src/gc/StoreBuffer.cpp

@@ -138,8 +138,8 @@ ArenaCellSet*
 StoreBuffer::WholeCellBuffer::allocateCellSet(Arena* arena)
 {
     Zone* zone = arena->zone;
-    Nursery& nursery = zone->group()->nursery();
-    if (!nursery.isEnabled())
+    JSRuntime* rt = zone->runtimeFromActiveCooperatingThread();
+    if (!rt->gc.nursery().isEnabled())
         return nullptr;
 
     AutoEnterOOMUnsafeRegion oomUnsafe;
@@ -151,7 +151,7 @@ StoreBuffer::WholeCellBuffer::allocateCellSet(Arena* arena)
     head_ = cells;
 
     if (isAboutToOverflow())
-        zone->group()->storeBuffer().setAboutToOverflow(JS::gcreason::FULL_WHOLE_CELL_BUFFER);
+        rt->gc.storeBuffer().setAboutToOverflow(JS::gcreason::FULL_WHOLE_CELL_BUFFER);
 
     return cells;
 }

js/src/gc/Zone.h

@@ -582,7 +582,9 @@ struct Zone : public JS::shadow::Zone,
         // If the cell was in the nursery, hopefully unlikely, then we need to
         // tell the nursery about it so that it can sweep the uid if the thing
         // does not get tenured.
-        if (IsInsideNursery(cell) && !group()->nursery().addedUniqueIdToCell(cell)) {
+        if (IsInsideNursery(cell) &&
+            !runtimeFromActiveCooperatingThread()->gc.nursery().addedUniqueIdToCell(cell))
+        {
             uniqueIds().remove(cell);
             return false;
         }

js/src/gc/ZoneGroup.cpp

@@ -19,24 +19,12 @@ ZoneGroup::ZoneGroup(JSRuntime* runtime)
   : runtime(runtime),
     helperThreadOwnerContext_(nullptr),
     zones_(this),
-    helperThreadUse(HelperThreadUse::None),
-#ifdef DEBUG
-    ionBailAfter_(this, 0),
-#endif
-    numFinishedBuilders(0),
-    ionLazyLinkListSize_(0)
+    helperThreadUse(HelperThreadUse::None)
 {}
 
 ZoneGroup::~ZoneGroup()
 {
-#ifdef DEBUG
     MOZ_ASSERT(helperThreadUse == HelperThreadUse::None);
-    {
-        AutoLockHelperThreadState lock;
-        MOZ_ASSERT(ionLazyLinkListSize_ == 0);
-        MOZ_ASSERT(ionLazyLinkList().isEmpty());
-    }
-#endif
 
     if (this == runtime->gc.systemZoneGroup)
         runtime->gc.systemZoneGroup = nullptr;
@@ -57,38 +45,6 @@ ZoneGroup::ownedByCurrentHelperThread()
     return helperThreadOwnerContext_ == TlsContext.get();
 }
 
-ZoneGroup::IonBuilderList&
-ZoneGroup::ionLazyLinkList()
-{
-    MOZ_ASSERT(CurrentThreadCanAccessRuntime(runtime),
-               "Should only be mutated by the active thread.");
-    return ionLazyLinkList_.ref();
-}
-
-void
-ZoneGroup::ionLazyLinkListRemove(jit::IonBuilder* builder)
-{
-    MOZ_ASSERT(CurrentThreadCanAccessRuntime(runtime),
-               "Should only be mutated by the active thread.");
-    MOZ_ASSERT(this == builder->script()->zone()->group());
-    MOZ_ASSERT(ionLazyLinkListSize_ > 0);
-
-    builder->removeFrom(ionLazyLinkList());
-    ionLazyLinkListSize_--;
-
-    MOZ_ASSERT(ionLazyLinkList().isEmpty() == (ionLazyLinkListSize_ == 0));
-}
-
-void
-ZoneGroup::ionLazyLinkListAdd(jit::IonBuilder* builder)
-{
-    MOZ_ASSERT(CurrentThreadCanAccessRuntime(runtime),
-               "Should only be mutated by the active thread.");
-    MOZ_ASSERT(this == builder->script()->zone()->group());
-    ionLazyLinkList().insertFront(builder);
-    ionLazyLinkListSize_++;
-}
-
 void
 ZoneGroup::deleteEmptyZone(Zone* zone)
 {

js/src/gc/ZoneGroup.h

@@ -82,52 +82,8 @@ class ZoneGroup
     explicit ZoneGroup(JSRuntime* runtime);
     ~ZoneGroup();
 
-    inline Nursery& nursery();
-    inline gc::StoreBuffer& storeBuffer();
-
-    inline bool isCollecting();
-    inline bool isGCScheduled();
-
     // Delete an empty zone after its contents have been merged.
     void deleteEmptyZone(Zone* zone);
-
-#ifdef DEBUG
-  private:
-    // The number of possible bailing places encounters before forcefully bailing
-    // in that place. Zero means inactive.
-    ZoneGroupData<uint32_t> ionBailAfter_;
-
-  public:
-    void* addressOfIonBailAfter() { return &ionBailAfter_; }
-
-    // Set after how many bailing places we should forcefully bail.
-    // Zero disables this feature.
-    void setIonBailAfter(uint32_t after) {
-        ionBailAfter_ = after;
-    }
-#endif
-
-    // Number of Ion compilations which were finished off thread and are
-    // waiting to be lazily linked. This is only set while holding the helper
-    // thread state lock, but may be read from at other times.
-    mozilla::Atomic<size_t> numFinishedBuilders;
-
-  private:
-    /* List of Ion compilation waiting to get linked. */
-    typedef mozilla::LinkedList<js::jit::IonBuilder> IonBuilderList;
-
-    js::HelperThreadLockData<IonBuilderList> ionLazyLinkList_;
-    js::HelperThreadLockData<size_t> ionLazyLinkListSize_;
-
-  public:
-    IonBuilderList& ionLazyLinkList();
-
-    size_t ionLazyLinkListSize() {
-        return ionLazyLinkListSize_;
-    }
-
-    void ionLazyLinkListRemove(js::jit::IonBuilder* builder);
-    void ionLazyLinkListAdd(js::jit::IonBuilder* builder);
 };
 
 } // namespace js

js/src/jit/CodeGenerator.cpp

@@ -10488,7 +10488,7 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints)
         for (size_t i = 0; i < graph.numConstants(); i++) {
             const Value& v = vp[i];
             if ((v.isObject() || v.isString()) && IsInsideNursery(v.toGCThing())) {
-                cx->zone()->group()->storeBuffer().putWholeCell(script);
+                cx->runtime()->gc.storeBuffer().putWholeCell(script);
                 break;
             }
         }

js/src/jit/CompileWrappers.cpp

@@ -167,7 +167,7 @@ CompileZone::isAtomsZone()
 const void*
 CompileZone::addressOfIonBailAfter()
 {
-    return zone()->group()->addressOfIonBailAfter();
+    return zone()->runtimeFromAnyThread()->jitRuntime()->addressOfIonBailAfter();
 }
 #endif
 
@@ -212,21 +212,22 @@ bool
 CompileZone::canNurseryAllocateStrings()
 {
     return nurseryExists() &&
-        zone()->group()->nursery().canAllocateStrings() &&
+        zone()->runtimeFromAnyThread()->gc.nursery().canAllocateStrings() &&
         zone()->allocNurseryStrings;
 }
 
 bool
 CompileZone::nurseryExists()
 {
-    return zone()->group()->nursery().exists();
+    return zone()->runtimeFromAnyThread()->gc.nursery().exists();
 }
 
 void
 CompileZone::setMinorGCShouldCancelIonCompilations()
 {
     MOZ_ASSERT(CurrentThreadCanAccessZone(zone()));
-    zone()->group()->storeBuffer().setShouldCancelIonCompilations();
+    JSRuntime* rt = zone()->runtimeFromActiveCooperatingThread();
+    rt->gc.storeBuffer().setShouldCancelIonCompilations();
 }
 
 JSCompartment*

js/src/jit/Ion.cpp

@@ -213,12 +213,21 @@ JitRuntime::JitRuntime()
     baselineDebugModeOSRHandler_(nullptr),
     trampolineCode_(nullptr),
     functionWrappers_(nullptr),
-    jitcodeGlobalTable_(nullptr)
+    jitcodeGlobalTable_(nullptr),
+#ifdef DEBUG
+    ionBailAfter_(0),
+#endif
+    numFinishedBuilders_(0),
+    ionLazyLinkListSize_(0)
 {
 }
 
 JitRuntime::~JitRuntime()
 {
+    MOZ_ASSERT(numFinishedBuilders_ == 0);
+    MOZ_ASSERT(ionLazyLinkListSize_ == 0);
+    MOZ_ASSERT(ionLazyLinkList_.ref().isEmpty());
+
     js_delete(functionWrappers_.ref());
 
     // By this point, the jitcode global table should be empty.
@@ -373,6 +382,38 @@ JitRuntime::debugTrapHandler(JSContext* cx)
     return debugTrapHandler_;
 }
 
+JitRuntime::IonBuilderList&
+JitRuntime::ionLazyLinkList(JSRuntime* rt)
+{
+    MOZ_ASSERT(CurrentThreadCanAccessRuntime(rt),
+               "Should only be mutated by the active thread.");
+    return ionLazyLinkList_.ref();
+}
+
+void
+JitRuntime::ionLazyLinkListRemove(JSRuntime* rt, jit::IonBuilder* builder)
+{
+    MOZ_ASSERT(CurrentThreadCanAccessRuntime(rt),
+               "Should only be mutated by the active thread.");
+    MOZ_ASSERT(rt == builder->script()->runtimeFromActiveCooperatingThread());
+    MOZ_ASSERT(ionLazyLinkListSize_ > 0);
+
+    builder->removeFrom(ionLazyLinkList(rt));
+    ionLazyLinkListSize_--;
+
+    MOZ_ASSERT(ionLazyLinkList(rt).isEmpty() == (ionLazyLinkListSize_ == 0));
+}
+
+void
+JitRuntime::ionLazyLinkListAdd(JSRuntime* rt, jit::IonBuilder* builder)
+{
+    MOZ_ASSERT(CurrentThreadCanAccessRuntime(rt),
+               "Should only be mutated by the active thread.");
+    MOZ_ASSERT(rt == builder->script()->runtimeFromActiveCooperatingThread());
+    ionLazyLinkList(rt).insertFront(builder);
+    ionLazyLinkListSize_++;
+}
+
 uint8_t*
 JSContext::allocateOsrTempData(size_t size)
 {
@@ -485,7 +526,7 @@ jit::FinishOffThreadBuilder(JSRuntime* runtime, IonBuilder* builder,
 
     // If the builder is still in one of the helper thread list, then remove it.
     if (builder->isInList())
-        builder->script()->zone()->group()->ionLazyLinkListRemove(builder);
+        runtime->jitRuntime()->ionLazyLinkListRemove(runtime, builder);
 
     // Clear the recompiling flag of the old ionScript, since we continue to
     // use the old ionScript if recompiling fails.
@@ -546,7 +587,7 @@ jit::LinkIonScript(JSContext* cx, HandleScript calleeScript)
         calleeScript->baselineScript()->removePendingIonBuilder(cx->runtime(), calleeScript);
 
         // Remove from pending.
-        cx->zone()->group()->ionLazyLinkListRemove(builder);
+        cx->runtime()->jitRuntime()->ionLazyLinkListRemove(cx->runtime(), builder);
     }
 
     {
@@ -1896,14 +1937,14 @@ CompileBackEnd(MIRGenerator* mir)
 
 // Find a builder which the current thread can finish.
 static IonBuilder*
-GetFinishedBuilder(ZoneGroup* group, GlobalHelperThreadState::IonBuilderVector& finished)
+GetFinishedBuilder(JSRuntime* rt, GlobalHelperThreadState::IonBuilderVector& finished,
+                   const AutoLockHelperThreadState& locked)
 {
     for (size_t i = 0; i < finished.length(); i++) {
         IonBuilder* testBuilder = finished[i];
-        if (testBuilder->script()->runtimeFromAnyThread() == group->runtime &&
-            testBuilder->script()->zone()->group() == group) {
+        if (testBuilder->script()->runtimeFromAnyThread() == rt) {
             HelperThreadState().remove(finished, &i);
-            group->numFinishedBuilders--;
+            rt->jitRuntime()->numFinishedBuildersRef(locked)--;
             return testBuilder;
         }
     }
@@ -1912,11 +1953,12 @@ GetFinishedBuilder(ZoneGroup* group, GlobalHelperThreadState::IonBuilderVector&
 }
 
 void
-AttachFinishedCompilations(ZoneGroup* group, JSContext* maybecx)
+AttachFinishedCompilations(JSContext* cx)
 {
-    MOZ_ASSERT_IF(maybecx, maybecx->zone()->group() == group);
+    JSRuntime* rt = cx->runtime();
+    MOZ_ASSERT(CurrentThreadCanAccessRuntime(rt));
 
-    if (!group->numFinishedBuilders)
+    if (!rt->jitRuntime() || !rt->jitRuntime()->numFinishedBuilders())
         return;
 
     AutoLockHelperThreadState lock;
@@ -1926,32 +1968,28 @@ AttachFinishedCompilations(ZoneGroup* group, JSContext* maybecx)
     // finished, failed or have been cancelled.
     while (true) {
         // Find a finished builder for the zone group.
-        IonBuilder* builder = GetFinishedBuilder(group, finished);
+        IonBuilder* builder = GetFinishedBuilder(rt, finished, lock);
         if (!builder)
             break;
 
         JSScript* script = builder->script();
         MOZ_ASSERT(script->hasBaselineScript());
-        script->baselineScript()->setPendingIonBuilder(group->runtime, script, builder);
-        group->ionLazyLinkListAdd(builder);
+        script->baselineScript()->setPendingIonBuilder(rt, script, builder);
+        rt->jitRuntime()->ionLazyLinkListAdd(rt, builder);
 
         // Don't keep more than 100 lazy link builders in a zone group.
-        // Link the oldest ones immediately. Only do this if we have a valid
-        // context to use (otherwise this method might have been called in the
-        // middle of a compartment change on the current thread's context).
-        if (maybecx) {
-            while (group->ionLazyLinkListSize() > 100) {
-                jit::IonBuilder* builder = group->ionLazyLinkList().getLast();
-                RootedScript script(maybecx, builder->script());
+        // Link the oldest ones immediately.
+        while (rt->jitRuntime()->ionLazyLinkListSize() > 100) {
+            jit::IonBuilder* builder = rt->jitRuntime()->ionLazyLinkList(rt).getLast();
+            RootedScript script(cx, builder->script());
 
-                AutoUnlockHelperThreadState unlock(lock);
-                AutoCompartment ac(maybecx, script);
-                jit::LinkIonScript(maybecx, script);
-            }
+            AutoUnlockHelperThreadState unlock(lock);
+            AutoCompartment ac(cx, script);
+            jit::LinkIonScript(cx, script);
         }
     }
 
-    MOZ_ASSERT(!group->numFinishedBuilders);
+    MOZ_ASSERT(!rt->jitRuntime()->numFinishedBuilders());
 }
 
 static void
@@ -1990,7 +2028,7 @@ TrackPropertiesForSingletonScopes(JSContext* cx, JSScript* script, BaselineFrame
 static void
 TrackIonAbort(JSContext* cx, JSScript* script, jsbytecode* pc, const char* message)
 {
-    if (!cx->runtime()->jitRuntime()->isOptimizationTrackingEnabled(cx->zone()->group()))
+    if (!cx->runtime()->jitRuntime()->isOptimizationTrackingEnabled(cx->runtime()))
         return;
 
     // Only bother tracking aborts of functions we're attempting to
@@ -2086,7 +2124,7 @@ IonCompile(JSContext* cx, JSScript* script,
     if (!builder)
         return AbortReason::Alloc;
 
-    if (cx->zone()->group()->storeBuffer().cancelIonCompilations())
+    if (cx->runtime()->gc.storeBuffer().cancelIonCompilations())
         builder->setNotSafeForMinorGC();
 
     MOZ_ASSERT(recompile == builder->script()->hasIonScript());

js/src/jit/Ion.h

@@ -145,7 +145,7 @@ LIRGraph* GenerateLIR(MIRGenerator* mir);
 CodeGenerator* GenerateCode(MIRGenerator* mir, LIRGraph* lir);
 CodeGenerator* CompileBackEnd(MIRGenerator* mir);
 
-void AttachFinishedCompilations(ZoneGroup* group, JSContext* maybecx);
+void AttachFinishedCompilations(JSContext* cx);
 void FinishOffThreadBuilder(JSRuntime* runtime, IonBuilder* builder,
                             const AutoLockHelperThreadState& lock);
 void FreeIonBuilder(IonBuilder* builder);

js/src/jit/IonBuilder.cpp

@@ -8647,7 +8647,7 @@ IonBuilder::addTypedArrayLengthAndData(MDefinition* obj,
         SharedMem<void*> data = tarr->as<TypedArrayObject>().viewDataEither();
         // Bug 979449 - Optimistically embed the elements and use TI to
         //              invalidate if we move them.
-        bool isTenured = !tarr->zone()->group()->nursery().isInside(data);
+        bool isTenured = !tarr->runtimeFromActiveCooperatingThread()->gc.nursery().isInside(data);
         if (isTenured && tarr->isSingleton()) {
             // The 'data' pointer of TypedArrayObject can change in rare circumstances
             // (ArrayBufferObject::changeContents).

js/src/jit/JitCompartment.h

@@ -135,6 +135,22 @@ class JitRuntime
     // Global table of jitcode native address => bytecode address mappings.
     UnprotectedData<JitcodeGlobalTable*> jitcodeGlobalTable_;
 
+#ifdef DEBUG
+    // The number of possible bailing places encounters before forcefully bailing
+    // in that place. Zero means inactive.
+    ActiveThreadData<uint32_t> ionBailAfter_;
+#endif
+
+    // Number of Ion compilations which were finished off thread and are
+    // waiting to be lazily linked. This is only set while holding the helper
+    // thread state lock, but may be read from at other times.
+    mozilla::Atomic<size_t> numFinishedBuilders_;
+
+    // List of Ion compilation waiting to get linked.
+    using IonBuilderList = mozilla::LinkedList<js::jit::IonBuilder>;
+    ActiveThreadData<IonBuilderList> ionLazyLinkList_;
+    ActiveThreadData<size_t> ionLazyLinkListSize_;
+
   private:
     void generateLazyLinkStub(MacroAssembler& masm);
     void generateInterpreterStub(MacroAssembler& masm);
@@ -272,9 +288,35 @@ class JitRuntime
         return rt->geckoProfiler().enabled();
     }
 
-    bool isOptimizationTrackingEnabled(ZoneGroup* group) {
-        return isProfilerInstrumentationEnabled(group->runtime);
+    bool isOptimizationTrackingEnabled(JSRuntime* rt) {
+        return isProfilerInstrumentationEnabled(rt);
     }
+
+#ifdef DEBUG
+    void* addressOfIonBailAfter() { return &ionBailAfter_; }
+
+    // Set after how many bailing places we should forcefully bail.
+    // Zero disables this feature.
+    void setIonBailAfter(uint32_t after) {
+        ionBailAfter_ = after;
+    }
+#endif
+
+    size_t numFinishedBuilders() const {
+        return numFinishedBuilders_;
+    }
+    mozilla::Atomic<size_t>& numFinishedBuildersRef(const AutoLockHelperThreadState& locked) {
+        return numFinishedBuilders_;
+    }
+
+    IonBuilderList& ionLazyLinkList(JSRuntime* rt);
+
+    size_t ionLazyLinkListSize() const {
+        return ionLazyLinkListSize_;
+    }
+
+    void ionLazyLinkListRemove(JSRuntime* rt, js::jit::IonBuilder* builder);
+    void ionLazyLinkListAdd(JSRuntime* rt, js::jit::IonBuilder* builder);
 };
 
 enum class CacheKind : uint8_t;

js/src/jit/JitFrames.cpp

@@ -975,7 +975,7 @@ TraceBailoutFrame(JSTracer* trc, const JSJitFrameIter& frame)
 }
 
 static void
-UpdateIonJSFrameForMinorGC(const JSJitFrameIter& frame)
+UpdateIonJSFrameForMinorGC(JSRuntime* rt, const JSJitFrameIter& frame)
 {
     // Minor GCs may move slots/elements allocated in the nursery. Update
     // any slots/elements pointers stored in this frame.
@@ -991,7 +991,7 @@ UpdateIonJSFrameForMinorGC(const JSJitFrameIter& frame)
         ionScript = frame.ionScriptFromCalleeToken();
     }
 
-    Nursery& nursery = ionScript->method()->zone()->group()->nursery();
+    Nursery& nursery = rt->gc.nursery();
 
     const SafepointIndex* si = ionScript->getSafepointIndex(frame.returnAddressToFp());
     SafepointReader safepoint(ionScript, si);
@@ -1315,7 +1315,7 @@ UpdateJitActivationsForMinorGC(JSRuntime* rt)
     for (JitActivationIterator activations(cx); !activations.done(); ++activations) {
         for (OnlyJSJitFrameIter iter(activations); !iter.done(); ++iter) {
             if (iter.frame().type() == JitFrame_IonJS)
-                UpdateIonJSFrameForMinorGC(iter.frame());
+                UpdateIonJSFrameForMinorGC(rt, iter.frame());
         }
     }
 }

js/src/jit/Linker.cpp

@@ -59,7 +59,7 @@ Linker::newCode(JSContext* cx, CodeKind kind)
     code->copyFrom(masm);
     masm.link(code);
     if (masm.embedsNurseryPointers())
-        cx->zone()->group()->storeBuffer().putWholeCell(code);
+        cx->runtime()->gc.storeBuffer().putWholeCell(code);
     return code;
 }
 

js/src/jit/MIR.cpp

@@ -962,8 +962,8 @@ jit::IonCompilationCanUseNurseryPointers()
     // Otherwise, we must be on the active thread during MIR construction. The
     // store buffer must have been notified that minor GCs must cancel pending
     // or in progress Ion compilations.
-    JSContext* cx = TlsContext.get();
-    return cx->zone()->group()->storeBuffer().cancelIonCompilations();
+    JSRuntime* rt = TlsContext.get()->zone()->runtimeFromActiveCooperatingThread();
+    return rt->gc.storeBuffer().cancelIonCompilations();
 }
 
 #endif // DEBUG

js/src/jit/VMFunctions.cpp

@@ -579,7 +579,7 @@ NewCallObject(JSContext* cx, HandleShape shape, HandleObjectGroup group)
     // the initializing writes. The interpreter, however, may have allocated
     // the call object tenured, so barrier as needed before re-entering.
     if (!IsInsideNursery(obj))
-        cx->zone()->group()->storeBuffer().putWholeCell(obj);
+        cx->runtime()->gc.storeBuffer().putWholeCell(obj);
 
     return obj;
 }
@@ -596,7 +596,7 @@ NewSingletonCallObject(JSContext* cx, HandleShape shape)
     // the call object tenured, so barrier as needed before re-entering.
     MOZ_ASSERT(!IsInsideNursery(obj),
                "singletons are created in the tenured heap");
-    cx->zone()->group()->storeBuffer().putWholeCell(obj);
+    cx->runtime()->gc.storeBuffer().putWholeCell(obj);
 
     return obj;
 }

js/src/jit/shared/CodeGenerator-shared.cpp

@@ -1062,7 +1062,8 @@ CodeGeneratorShared::verifyCompactTrackedOptimizationsMap(JitCode* code, uint32_
             // decoded. This is disabled for now if the types table might
             // contain nursery pointers, in which case the types might not
             // match, see bug 1175761.
-            if (!code->zone()->group()->storeBuffer().cancelIonCompilations()) {
+            JSRuntime* rt = code->runtimeFromActiveCooperatingThread();
+            if (!rt->gc.storeBuffer().cancelIonCompilations()) {
                 IonTrackedOptimizationsTypeInfo typeInfo = typesTable->entry(index);
                 TempOptimizationTypeInfoVector tvec(alloc());
                 ReadTempTypeInfoVectorOp top(alloc(), &tvec);

js/src/jsfriendapi.cpp

@@ -1219,7 +1219,7 @@ void
 js::DumpHeap(JSContext* cx, FILE* fp, js::DumpHeapNurseryBehaviour nurseryBehaviour)
 {
     if (nurseryBehaviour == js::CollectNurseryBeforeDump)
-        EvictAllNurseries(cx->runtime(), JS::gcreason::API);
+        cx->runtime()->gc.evictNursery(JS::gcreason::API);
 
     DumpHeapTracer dtrc(fp, cx);
 

js/src/proxy/CrossCompartmentWrapper.cpp

@@ -706,7 +706,7 @@ js::RecomputeWrappers(JSContext* cx, const CompartmentFilter& sourceFilter,
             continue;
 
         if (!evictedNursery && c->hasNurseryAllocatedWrapperEntries(targetFilter)) {
-            EvictAllNurseries(cx->runtime());
+            cx->runtime()->gc.evictNursery();
             evictedNursery = true;
         }
 

js/src/shell/js.cpp

@@ -5934,7 +5934,7 @@ ReflectTrackedOptimizations(JSContext* cx, unsigned argc, Value* vp)
     RootedObject callee(cx, &args.callee());
     JSRuntime* rt = cx->runtime();
 
-    if (!rt->hasJitRuntime() || !rt->jitRuntime()->isOptimizationTrackingEnabled(cx->zone()->group())) {
+    if (!rt->hasJitRuntime() || !rt->jitRuntime()->isOptimizationTrackingEnabled(cx->runtime())) {
         JS_ReportErrorASCII(cx, "Optimization tracking is off.");
         return false;
     }

js/src/vm/ArgumentsObject.cpp

@@ -868,7 +868,7 @@ ArgumentsObject::objectMoved(JSObject* dst, JSObject* src)
     if (!IsInsideNursery(src))
         return 0;
 
-    Nursery& nursery = dst->zone()->group()->nursery();
+    Nursery& nursery = dst->runtimeFromActiveCooperatingThread()->gc.nursery();
 
     size_t nbytesTotal = 0;
     if (!nursery.isInside(nsrc->data())) {

js/src/vm/ArrayBufferObject.cpp

@@ -1653,7 +1653,7 @@ ArrayBufferViewObject::trace(JSTracer* trc, JSObject* objArg)
                 // not be enough bytes available, and other views might have data
                 // pointers whose forwarding pointers would overlap this one.
                 if (trc->isTenuringTracer()) {
-                    Nursery& nursery = obj->zoneFromAnyThread()->group()->nursery();
+                    Nursery& nursery = trc->runtime()->gc.nursery();
                     nursery.maybeSetForwardingPointer(trc, srcData, dstData, /* direct = */ false);
                 }
             } else {

js/src/vm/HelperThreads.cpp

@@ -209,7 +209,7 @@ FinishOffThreadIonCompile(jit::IonBuilder* builder, const AutoLockHelperThreadSt
     AutoEnterOOMUnsafeRegion oomUnsafe;
     if (!HelperThreadState().ionFinishedList(lock).append(builder))
         oomUnsafe.crash("FinishOffThreadIonCompile");
-    builder->script()->zoneFromAnyThread()->group()->numFinishedBuilders++;
+    builder->script()->runtimeFromAnyThread()->jitRuntime()->numFinishedBuildersRef(lock)++;
 }
 
 static JSRuntime*
@@ -309,8 +309,9 @@ CancelOffThreadIonCompileLocked(const CompilationSelector& selector, bool discar
     for (size_t i = 0; i < finished.length(); i++) {
         jit::IonBuilder* builder = finished[i];
         if (IonBuilderMatches(selector, builder)) {
-            builder->script()->zoneFromAnyThread()->group()->numFinishedBuilders--;
-            jit::FinishOffThreadBuilder(builder->script()->runtimeFromAnyThread(), builder, lock);
+            JSRuntime* rt = builder->script()->runtimeFromAnyThread();
+            rt->jitRuntime()->numFinishedBuildersRef(lock)--;
+            jit::FinishOffThreadBuilder(rt, builder, lock);
             HelperThreadState().remove(finished, &i);
         }
     }
@@ -319,14 +320,12 @@ CancelOffThreadIonCompileLocked(const CompilationSelector& selector, bool discar
     if (discardLazyLinkList) {
         MOZ_ASSERT(!selector.is<AllCompilations>());
         JSRuntime* runtime = GetSelectorRuntime(selector);
-        for (ZoneGroupsIter group(runtime); !group.done(); group.next()) {
-            jit::IonBuilder* builder = group->ionLazyLinkList().getFirst();
-            while (builder) {
-                jit::IonBuilder* next = builder->getNext();
-                if (IonBuilderMatches(selector, builder))
-                    jit::FinishOffThreadBuilder(runtime, builder, lock);
-                builder = next;
-            }
+        jit::IonBuilder* builder = runtime->jitRuntime()->ionLazyLinkList(runtime).getFirst();
+        while (builder) {
+            jit::IonBuilder* next = builder->getNext();
+            if (IonBuilderMatches(selector, builder))
+                jit::FinishOffThreadBuilder(runtime, builder, lock);
+            builder = next;
         }
     }
 }
@@ -369,7 +368,8 @@ js::HasOffThreadIonCompile(JSCompartment* comp)
             return true;
     }
 
-    jit::IonBuilder* builder = comp->zone()->group()->ionLazyLinkList().getFirst();
+    JSRuntime* rt = comp->runtimeFromActiveCooperatingThread();
+    jit::IonBuilder* builder = rt->jitRuntime()->ionLazyLinkList(rt).getFirst();
     while (builder) {
         if (builder->script()->compartment() == comp)
             return true;
@@ -2108,8 +2108,9 @@ GlobalHelperThreadState::trace(JSTracer* trc, gc::AutoTraceSession& session)
         }
     }
 
-    for (ZoneGroupsIter group(trc->runtime()); !group.done(); group.next()) {
-        jit::IonBuilder* builder = group->ionLazyLinkList().getFirst();
+    JSRuntime* rt = trc->runtime();
+    if (auto* jitRuntime = rt->jitRuntime()) {
+        jit::IonBuilder* builder = jitRuntime->ionLazyLinkList(rt).getFirst();
         while (builder) {
             builder->trace(trc);
             builder = builder->getNext();

js/src/vm/JSObject.cpp

@@ -1558,13 +1558,13 @@ JSObject::fixDictionaryShapeAfterSwap()
 }
 
 static MOZ_MUST_USE bool
-CopyProxyValuesBeforeSwap(ProxyObject* proxy, Vector<Value>& values)
+CopyProxyValuesBeforeSwap(JSContext* cx, ProxyObject* proxy, Vector<Value>& values)
 {
     MOZ_ASSERT(values.empty());
 
     // Remove the GCPtrValues we're about to swap from the store buffer, to
     // ensure we don't trace bogus values.
-    StoreBuffer& sb = proxy->zone()->group()->storeBuffer();
+    StoreBuffer& sb = cx->runtime()->gc.storeBuffer();
 
     // Reserve space for the private slot and the reserved slots.
     if (!values.reserve(1 + proxy->numReservedSlots()))
@@ -1635,8 +1635,8 @@ JSObject::swap(JSContext* cx, HandleObject a, HandleObject b)
      * nursery pointers in either object.
      */
     MOZ_ASSERT(!IsInsideNursery(a) && !IsInsideNursery(b));
-    cx->zone()->group()->storeBuffer().putWholeCell(a);
-    cx->zone()->group()->storeBuffer().putWholeCell(b);
+    cx->runtime()->gc.storeBuffer().putWholeCell(a);
+    cx->runtime()->gc.storeBuffer().putWholeCell(b);
 
     unsigned r = NotifyGCPreSwap(a, b);
 
@@ -1722,11 +1722,11 @@ JSObject::swap(JSContext* cx, HandleObject a, HandleObject b)
         ProxyObject* proxyB = b->is<ProxyObject>() ? &b->as<ProxyObject>() : nullptr;
 
         if (aIsProxyWithInlineValues) {
-            if (!CopyProxyValuesBeforeSwap(proxyA, avals))
+            if (!CopyProxyValuesBeforeSwap(cx, proxyA, avals))
                 oomUnsafe.crash("CopyProxyValuesBeforeSwap");
         }
         if (bIsProxyWithInlineValues) {
-            if (!CopyProxyValuesBeforeSwap(proxyB, bvals))
+            if (!CopyProxyValuesBeforeSwap(cx, proxyB, bvals))
                 oomUnsafe.crash("CopyProxyValuesBeforeSwap");
         }
 
@@ -3885,7 +3885,7 @@ JSObject::sizeOfIncludingThisInNursery() const
 
     MOZ_ASSERT(!isTenured());
 
-    const Nursery& nursery = zone()->group()->nursery();
+    const Nursery& nursery = runtimeFromActiveCooperatingThread()->gc.nursery();
     size_t size = Arena::thingSize(allocKindForTenure(nursery));
 
     if (is<NativeObject>()) {

js/src/vm/NativeObject-inl.h

@@ -124,9 +124,10 @@ NativeObject::elementsRangeWriteBarrierPost(uint32_t start, uint32_t count)
     for (size_t i = 0; i < count; i++) {
         const Value& v = elements_[start + i];
         if ((v.isObject() || v.isString()) && IsInsideNursery(v.toGCThing())) {
-            zone()->group()->storeBuffer().putSlot(this, HeapSlot::Element,
-                                                   unshiftedIndex(start + i),
-                                                   count - i);
+            JSRuntime* rt = runtimeFromActiveCooperatingThread();
+            rt->gc.storeBuffer().putSlot(this, HeapSlot::Element,
+                                         unshiftedIndex(start + i),
+                                         count - i);
             return;
         }
     }

js/src/vm/Runtime.cpp

@@ -434,7 +434,7 @@ InvokeInterruptCallback(JSContext* cx)
 
     // A worker thread may have requested an interrupt after finishing an Ion
     // compilation.
-    jit::AttachFinishedCompilations(cx->zone()->group(), cx);
+    jit::AttachFinishedCompilations(cx);
 
     // Important: Additional callbacks can occur inside the callback handler
     // if it re-enters the JS engine. The embedding must ensure that the

js/src/vm/Runtime.h

@@ -1146,18 +1146,6 @@ SetValueRangeToNull(Value* vec, size_t len)
 
 extern const JSSecurityCallbacks NullSecurityCallbacks;
 
-inline Nursery&
-ZoneGroup::nursery()
-{
-    return runtime->gc.nursery();
-}
-
-inline gc::StoreBuffer&
-ZoneGroup::storeBuffer()
-{
-    return runtime->gc.storeBuffer();
-}
-
 // This callback is set by JS::SetProcessLargeAllocationFailureCallback
 // and may be null. See comment in jsapi.h.
 extern mozilla::Atomic<JS::LargeAllocationFailureCallback> OnLargeAllocationFailure;

js/src/vm/StringType.cpp

@@ -510,7 +510,7 @@ JSRope::flattenInternal(JSContext* maybecx)
                 left.d.u1.flags = DEPENDENT_FLAGS | LATIN1_CHARS_BIT;
             left.d.s.u3.base = (JSLinearString*)this;  /* will be true on exit */
             BarrierMethods<JSString*>::postBarrier((JSString**)&left.d.s.u3.base, nullptr, this);
-            Nursery& nursery = zone()->group()->nursery();
+            Nursery& nursery = runtimeFromActiveCooperatingThread()->gc.nursery();
             if (isTenured() && !left.isTenured())
                 nursery.removeMallocedBuffer(wholeChars);
             else if (!isTenured() && left.isTenured())
@@ -526,7 +526,7 @@ JSRope::flattenInternal(JSContext* maybecx)
     }
 
     if (!isTenured()) {
-        Nursery& nursery = zone()->group()->nursery();
+        Nursery& nursery = runtimeFromActiveCooperatingThread()->gc.nursery();
         if (!nursery.registerMallocedBuffer(wholeChars)) {
             js_free(wholeChars);
             if (maybecx)

js/src/vm/TypeInference.cpp

@@ -685,8 +685,8 @@ void
 ConstraintTypeSet::postWriteBarrier(JSContext* cx, Type type)
 {
     if (type.isSingletonUnchecked() && IsInsideNursery(type.singletonNoBarrier())) {
-        cx->zone()->group()->storeBuffer().putGeneric(TypeSetRef(cx->zone(), this));
-        cx->zone()->group()->storeBuffer().setShouldCancelIonCompilations();
+        cx->runtime()->gc.storeBuffer().putGeneric(TypeSetRef(cx->zone(), this));
+        cx->runtime()->gc.storeBuffer().setShouldCancelIonCompilations();
     }
 }
 

js/src/vm/TypedArrayObject.cpp

@@ -196,7 +196,7 @@ TypedArrayObject::objectMoved(JSObject* obj, JSObject* old)
         return 0;
     }
 
-    Nursery& nursery = obj->zone()->group()->nursery();
+    Nursery& nursery = obj->runtimeFromActiveCooperatingThread()->gc.nursery();
     void* buf = oldObj->elements();
 
     if (!nursery.isInside(buf)) {
@@ -494,7 +494,7 @@ class TypedArrayObjectTemplate : public TypedArrayObject
                     MOZ_ASSERT(buffer->byteLength() == 0 &&
                                (uintptr_t(ptr.unwrapValue()) & gc::ChunkMask) == 0);
                 } else {
-                    cx->zone()->group()->storeBuffer().putWholeCell(obj);
+                    cx->runtime()->gc.storeBuffer().putWholeCell(obj);
                 }
             }
         } else {

js/src/vm/UnboxedObject-inl.h

@@ -47,54 +47,6 @@ GetUnboxedValue(uint8_t* p, JSValueType type, bool maybeUninitialized)
     }
 }
 
-static inline void
-SetUnboxedValueNoTypeChange(JSObject* unboxedObject,
-                            uint8_t* p, JSValueType type, const Value& v,
-                            bool preBarrier)
-{
-    switch (type) {
-      case JSVAL_TYPE_BOOLEAN:
-        *p = v.toBoolean();
-        return;
-
-      case JSVAL_TYPE_INT32:
-        *reinterpret_cast<int32_t*>(p) = v.toInt32();
-        return;
-
-      case JSVAL_TYPE_DOUBLE:
-        *reinterpret_cast<double*>(p) = v.toNumber();
-        return;
-
-      case JSVAL_TYPE_STRING: {
-        MOZ_ASSERT(!IsInsideNursery(v.toString()));
-        JSString** np = reinterpret_cast<JSString**>(p);
-        if (preBarrier)
-            JSString::writeBarrierPre(*np);
-        *np = v.toString();
-        return;
-      }
-
-      case JSVAL_TYPE_OBJECT: {
-        JSObject** np = reinterpret_cast<JSObject**>(p);
-
-        // Manually trigger post barriers on the whole object. If we treat
-        // the pointer as a HeapPtrObject we will get confused later if the
-        // object is converted to its native representation.
-        JSObject* obj = v.toObjectOrNull();
-        if (IsInsideNursery(obj) && !IsInsideNursery(unboxedObject))
-            unboxedObject->zone()->group()->storeBuffer().putWholeCell(unboxedObject);
-
-        if (preBarrier)
-            JSObject::writeBarrierPre(*np);
-        *np = obj;
-        return;
-      }
-
-      default:
-        MOZ_CRASH("Invalid type for unboxed value");
-    }
-}
-
 static inline bool
 SetUnboxedValue(JSContext* cx, JSObject* unboxedObject, jsid id,
                 uint8_t* p, JSValueType type, const Value& v, bool preBarrier)
@@ -125,7 +77,7 @@ SetUnboxedValue(JSContext* cx, JSObject* unboxedObject, jsid id,
         if (v.isString()) {
             JSString** np = reinterpret_cast<JSString**>(p);
             if (IsInsideNursery(v.toString()) && !IsInsideNursery(unboxedObject))
-                unboxedObject->zone()->group()->storeBuffer().putWholeCell(unboxedObject);
+                v.toString()->storeBuffer()->putWholeCell(unboxedObject);
 
             if (preBarrier)
                 JSString::writeBarrierPre(*np);
@@ -145,8 +97,8 @@ SetUnboxedValue(JSContext* cx, JSObject* unboxedObject, jsid id,
 
             // As above, trigger post barriers on the whole object.
             JSObject* obj = v.toObjectOrNull();
-            if (IsInsideNursery(v.toObjectOrNull()) && !IsInsideNursery(unboxedObject))
-                unboxedObject->zone()->group()->storeBuffer().putWholeCell(unboxedObject);
+            if (IsInsideNursery(obj) && !IsInsideNursery(unboxedObject))
+                obj->storeBuffer()->putWholeCell(unboxedObject);
 
             if (preBarrier)
                 JSObject::writeBarrierPre(*np);

js/src/vm/UnboxedObject.cpp

@@ -384,7 +384,7 @@ UnboxedPlainObject::ensureExpando(JSContext* cx, Handle<UnboxedPlainObject*> obj
     // convert the object to its native representation, we will end up with a
     // corrupted store buffer entry.
     if (IsInsideNursery(expando) && !IsInsideNursery(obj))
-        cx->zone()->group()->storeBuffer().putWholeCell(obj);
+        expando->storeBuffer()->putWholeCell(obj);
 
     obj->setExpandoUnsafe(expando);
     return expando;
@@ -599,7 +599,7 @@ UnboxedPlainObject::convertToNative(JSContext* cx, JSObject* obj)
     // writes to the expando (see WholeCellEdges::trace), so after conversion
     // we need to make sure the expando itself will still be traced.
     if (expando && !IsInsideNursery(expando))
-        cx->zone()->group()->storeBuffer().putWholeCell(expando);
+        cx->runtime()->gc.storeBuffer().putWholeCell(expando);
 
     obj->setGroup(layout.nativeGroup());
     obj->as<PlainObject>().setLastPropertyMakeNative(cx, layout.nativeShape());

modules/freetype2/README.moz-patches

@@ -2,10 +2,11 @@ This directory contains FreeType v2.9 downloaded from
 https://download.savannah.gnu.org/releases/freetype/
 
 The following post-2.9 commits have been cherry-picked from
-the upstream FreeType repository (see bug 1434697, bug 1438522):
+the upstream FreeType repository (see bug 1434697, bug 1438522, bug 1453653):
 
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=994eb2b34934bc5face9f83b2d3b12cf7a9262ab
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=cc2f3cdecff5a351e7e8961b9f2e389ab740231a
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=4a03f17449ae45f0dacf4de4694ccd6e5e1b24d1
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=68dddcdcbe18a08d778026efc01b1369e35cbf6a
 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=29c759284e305ec428703c9a5831d0b1fc3497ef
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=bd9400bd464f6cd7c74f52ece1c1065fe2a87aab

modules/freetype2/src/truetype/ttinterp.c

@@ -2165,7 +2165,7 @@
       val = ADD_LONG( distance,
                       exc->threshold - exc->phase + compensation ) &
               -exc->period;
-      val += exc->phase;
+      val = ADD_LONG( val, exc->phase );
       if ( val < 0 )
         val = exc->phase;
     }
@@ -2174,7 +2174,7 @@
       val = NEG_LONG( SUB_LONG( exc->threshold - exc->phase + compensation,
                                 distance ) &
                         -exc->period );
-      val -= exc->phase;
+      val = SUB_LONG( val, exc->phase );
       if ( val > 0 )
         val = -exc->phase;
     }
@@ -2216,7 +2216,7 @@
       val = ( ADD_LONG( distance,
                         exc->threshold - exc->phase + compensation ) /
                 exc->period ) * exc->period;
-      val += exc->phase;
+      val = ADD_LONG( val, exc->phase );
       if ( val < 0 )
         val = exc->phase;
     }
@@ -2225,7 +2225,7 @@
       val = NEG_LONG( ( SUB_LONG( exc->threshold - exc->phase + compensation,
                                   distance ) /
                           exc->period ) * exc->period );
-      val -= exc->phase;
+      val = SUB_LONG( val, exc->phase );
       if ( val > 0 )
         val = -exc->phase;
     }

taskcluster/ci/config.yml

@@ -58,6 +58,7 @@ treeherder:
         'ps': 'Partials signing'
         'Rel': 'Release promotion'
         'Snap': 'Snap image generation'
+        'langpack': 'Langpack sigatures and uploads'
 
 index:
     products:

taskcluster/ci/post-langpack-dummy/kind.yml

@@ -0,0 +1,48 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.transform:loader
+
+transforms:
+   - taskgraph.transforms.reverse_chunk_deps:transforms
+   - taskgraph.transforms.release_notifications:transforms
+   - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+   - release-beetmover-signed-langpacks
+
+jobs:
+   firefox-promote:
+      name: post-langpack-dummy
+      description: Dummy task to deal with max_dependencies
+      run-on-projects: []
+      shipping-phase: promote
+      shipping-product: firefox
+      worker-type: aws-provisioner-v1/gecko-{level}-b-linux
+      worker:
+         implementation: docker-worker
+         os: linux
+         docker-image: "ubuntu:16.10"
+         max-run-time: 600
+         command:
+            - /bin/bash
+            - -c
+            - echo "Dummy task"
+
+   devedition-promote:
+      name: post-langpack-dummy
+      description: Dummy task to deal with max_dependencies
+      run-on-projects: []
+      shipping-phase: promote
+      shipping-product: devedition
+      worker-type: aws-provisioner-v1/gecko-{level}-b-linux
+      worker:
+         implementation: docker-worker
+         os: linux
+         docker-image: "ubuntu:16.10"
+         max-run-time: 600
+         command:
+            - /bin/bash
+            - -c
+            - echo "Dummy task"

taskcluster/ci/release-beetmover-signed-langpacks/kind.yml

@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.single_dep:loader
+
+transforms:
+   - taskgraph.transforms.name_sanity:transforms
+   - taskgraph.transforms.release_beetmover_signed_addons:transforms
+   - taskgraph.transforms.release_notifications:transforms
+   - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+   - release-sign-and-push-langpacks
+
+only-for-attributes:
+   - nightly
+
+job-template:
+   description: Beetmover submission for platform-independent langpacks {locales} in {platform} directory
+   worker-type:
+      by-project:
+         mozilla-beta: scriptworker-prov-v1/beetmoverworker-v1
+         mozilla-release: scriptworker-prov-v1/beetmoverworker-v1
+         default: scriptworker-prov-v1/beetmoverworker-dev
+   run-on-projects: []
+   shipping-phase: promote
+   shipping-product: firefox

taskcluster/ci/release-generate-checksums/kind.yml

@@ -7,6 +7,7 @@ loader: taskgraph.loader.transform:loader
 kind-dependencies:
    - beetmover-source
    - post-beetmover-checksums-dummy
+   - release-beetmover-signed-langpacks
 
 transforms:
    - taskgraph.transforms.build:transforms

taskcluster/ci/release-sign-and-push-langpacks/kind.yml

@@ -0,0 +1,48 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.single_dep:loader
+
+transforms:
+   - taskgraph.transforms.release_sign_and_push_langpacks:transforms
+   - taskgraph.transforms.release_notifications:transforms
+   - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+   - build
+   - nightly-l10n
+
+
+only-for-build-platforms:
+   - linux64-nightly/opt    # addons.mozilla.org only support 1 platform per locale. That's why we use linux64
+   - macosx64-nightly/opt   # Although, we need the special locale "ja-JP-Mac" from this platform
+   # TODO Activate devedition
+
+
+job-template:
+   description: Signs {locales} XPIs for platform via addons.mozilla.org and pushes them
+   worker-type:
+      by-project:
+         mozilla-beta: scriptworker-prov-v1/addon-v1
+         mozilla-release: scriptworker-prov-v1/addon-v1
+         default: scriptworker-prov-v1/addon-dev
+   worker:
+      implementation: sign-and-push-addons
+      channel:
+         by-project:
+            # Only release langpacks are listed publicly
+            mozilla-release: listed
+            default: unlisted
+      upstream-artifacts:   # See transforms
+   run-on-projects: []
+   scopes:
+      by-project:
+         mozilla-beta:
+            - project:releng:addons.mozilla.org:server:production
+         mozilla-release:
+            - project:releng:addons.mozilla.org:server:production
+         default:
+            - project:releng:addons.mozilla.org:server:staging
+   shipping-phase: promote
+   shipping-product: firefox

taskcluster/ci/release-snap-repackage/kind.yml

@@ -12,6 +12,7 @@ transforms:
 
 kind-dependencies:
    - post-beetmover-dummy
+   - post-langpack-dummy
 
 job-defaults:
    description: Generates snap image

taskcluster/ci/test/talos.yml

@@ -54,6 +54,38 @@ talos-chrome-profiling:
             - --add-option
             - --webServer,localhost
 
+talos-damp:
+    description: "Talos devtools (damp)"
+    try-name: damp
+    treeherder-symbol: T(damp)
+    max-run-time:
+        by-test-platform:
+            linux64.*: 2700
+            default: 5400
+    run-on-projects:
+        by-test-platform:
+            .*-qr/.*: ['mozilla-central', 'try']
+            linux64-ccov/.*: ['try']  # Bug 1407593
+            default: ['mozilla-beta', 'mozilla-central', 'mozilla-inbound', 'autoland', 'try']
+    mozharness:
+        extra-options:
+            - --suite=damp
+            - --add-option
+            - --webServer,localhost
+
+talos-damp-profiling:
+    description: "Talos profiling devtools"
+    try-name: damp-profiling
+    treeherder-symbol: T-P(damp)
+    run-on-projects: ['mozilla-central', 'try']
+    max-run-time: 1200
+    mozharness:
+        extra-options:
+            - --suite=damp
+            - --geckoProfile
+            - --add-option
+            - --webServer,localhost
+
 talos-dromaeojs:
     description: "Talos dromaeojs"
     try-name: dromaeojs
@@ -129,41 +161,6 @@ talos-g1-profiling:
             - --add-option
             - --webServer,localhost
 
-talos-g2:
-    description: "Talos g2"
-    try-name: g2
-    treeherder-symbol: T(g2)
-    max-run-time:
-        by-test-platform:
-            linux64.*: 2700
-            default: 7200
-    run-on-projects:
-        by-test-platform:
-            .*-qr/.*: ['mozilla-central', 'try']
-            linux64-ccov/.*: ['try']  # Bug 1407593
-            default: ['mozilla-beta', 'mozilla-central', 'mozilla-inbound', 'autoland', 'try']
-    mozharness:
-        extra-options:
-            - --suite=g2
-            - --add-option
-            - --webServer,localhost
-
-talos-g2-profiling:
-    description: "Talos profiling g2"
-    try-name: g2-profiling
-    treeherder-symbol: T-P(g2)
-    max-run-time:
-        by-test-platform:
-            linux64.*: 2700
-            default: 7200
-    run-on-projects: ['mozilla-central', 'try']
-    mozharness:
-        extra-options:
-            - --suite=g2
-            - --geckoProfile
-            - --add-option
-            - --webServer,localhost
-
 talos-g3:
     description: "Talos g3"
     try-name: g3
@@ -527,6 +524,35 @@ talos-tp6-stylo-threads:
         extra-options:
             - --suite=tp6-stylo-threads
 
+talos-tps:
+    description: "Talos page scroll (tps)"
+    try-name: tps
+    treeherder-symbol: T(tps)
+    max-run-time: 900
+    run-on-projects:
+        by-test-platform:
+            .*-qr/.*: ['mozilla-central', 'try']
+            linux64-ccov/.*: ['try']  # Bug 1407593
+            default: ['mozilla-beta', 'mozilla-central', 'mozilla-inbound', 'autoland', 'try']
+    mozharness:
+        extra-options:
+            - --suite=tps
+            - --add-option
+            - --webServer,localhost
+
+talos-tps-profiling:
+    description: "Talos page scroll profiling (tps)"
+    try-name: tps-profiling
+    treeherder-symbol: T-P(tps)
+    max-run-time: 900
+    run-on-projects: ['mozilla-central', 'try']
+    mozharness:
+        extra-options:
+            - --suite=tps
+            - --geckoProfile
+            - --add-option
+            - --webServer,localhost
+
 talos-xperf:
     description: "Talos xperf"
     try-name: xperf

taskcluster/ci/test/test-sets.yml

@@ -56,9 +56,9 @@ opt-only-tests:
 
 talos:
     - talos-chrome
+    - talos-damp
     - talos-dromaeojs
     - talos-g1
-    - talos-g2
     - talos-g3
     - talos-g4
     - talos-g5
@@ -69,6 +69,7 @@ talos:
     - talos-perf-reftest-singletons
     - talos-tp6
     - talos-tp6-stylo-threads
+    - talos-tps
     - talos-speedometer
     - talos-motionmark
     - talos-h1
@@ -119,9 +120,9 @@ linux-qr-tests:
 
 linux-talos-profiling:
     - talos-chrome-profiling
+    - talos-damp-profiling
     - talos-dromaeojs-profiling
     - talos-g1-profiling
-    - talos-g2-profiling
     - talos-g3-profiling
     - talos-g4-profiling
     - talos-g5-profiling
@@ -133,6 +134,7 @@ linux-talos-profiling:
     - talos-svgr-profiling
     - talos-tp5o-profiling
     - talos-tp6-profiling
+    # - talos-tps-profiling # Bug 1453007 - times out
 
 linux-talos-flex:
     - talos-flex
@@ -194,9 +196,9 @@ windows-tests:
 
 windows-talos:
     - talos-chrome
+    - talos-damp
     - talos-dromaeojs
     - talos-g1
-    - talos-g2
     - talos-g4
     - talos-g5
     - talos-other
@@ -207,14 +209,15 @@ windows-talos:
     - talos-xperf
     - talos-speedometer
     - talos-tp6
+    - talos-tps
     - talos-motionmark
     - talos-h1
 
 windows-talos-profiling:
     - talos-chrome-profiling
+    - talos-damp-profiling
     - talos-dromaeojs-profiling
     - talos-g1-profiling
-    - talos-g2-profiling
     - talos-g3-profiling
     - talos-g4-profiling
     - talos-g5-profiling
@@ -226,6 +229,7 @@ windows-talos-profiling:
     - talos-svgr-profiling
     - talos-tp5o-profiling
     - talos-tp6-profiling
+    - talos-tps-profiling
 
 macosx64-tests:
     - cppunit
@@ -255,9 +259,9 @@ macosx64-tests:
 
 macosx64-talos:
     - talos-chrome
+    - talos-damp
     - talos-dromaeojs
     - talos-g1
-    - talos-g2
     - talos-g4
     - talos-g5
     - talos-other
@@ -267,15 +271,16 @@ macosx64-talos:
     - talos-perf-reftest-singletons
     - talos-tp6
     - talos-tp6-stylo-threads
+    # - talos-tps # Bug 1453007 times out
     - talos-speedometer
     - talos-motionmark
     - talos-h1
 
 macosx64-talos-profiling:
     - talos-chrome-profiling
+    - talos-damp-profiling
     - talos-dromaeojs-profiling
     - talos-g1-profiling
-    - talos-g2-profiling
     - talos-g3-profiling
     - talos-g4-profiling
     - talos-g5-profiling
@@ -287,6 +292,7 @@ macosx64-talos-profiling:
     - talos-svgr-profiling
     - talos-tp5o-profiling
     - talos-tp6-profiling
+    # - talos-tps-profiling # Bug 1453007 times out
 
 linux32-tests:
     - cppunit

taskcluster/docs/kinds.rst

@@ -310,6 +310,14 @@ release-secondary-final-verify
 ------------------------------
 Verifies the contents and package of release update MARs for RC releases.
 
+release-sign-and-push-langpacks
+-------------------------------
+Sign a langpack XPI and publishes it onto addons.mozilla.org.
+
+release-beetmover-signed-langpacks
+----------------------------------
+Publishes signed langpacks to archive.mozilla.org
+
 release-update-verify
 ---------------------
 Verifies the contents and package of release update MARs.
@@ -395,6 +403,10 @@ post-beetmover-checksums-dummy
 ------------------------------
 Dummy tasks to consolidate beetmover-checksums dependencies to avoid taskcluster limits on number of dependencies per task.
 
+post-langpack-dummy
+------------------------------
+Dummy tasks to consolidate language pack beetmover dependencies to avoid taskcluster limits on number of dependencies per task.
+
 packages
 --------
 Tasks used to build packages for use in docker images.

taskcluster/taskgraph/transforms/beetmover_repackage.py

@@ -55,15 +55,6 @@ _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_EN_US = [
     "target_info.txt",
     "target.jsshell.zip",
     "mozharness.zip",
-    "target.langpack.xpi",
-]
-
-# Until bug 1331141 is fixed, if you are adding any new artifacts here that
-# need to be transfered to S3, please be aware you also need to follow-up
-# with a beetmover patch in https://github.com/mozilla-releng/beetmoverscript/.
-# See example in bug 1348286
-_DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_L10N = [
-    "target.langpack.xpi",
 ]
 
 # Until bug 1331141 is fixed, if you are adding any new artifacts here that
@@ -71,18 +62,36 @@ _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_L10N = [
 # with a beetmover patch in https://github.com/mozilla-releng/beetmoverscript/.
 # See example in bug 1348286
 UPSTREAM_ARTIFACT_UNSIGNED_PATHS = {
-    r'^(linux(|64)|macosx64)(|-devedition)-nightly$':
+    r'^(linux(|64)|macosx64)-nightly$':
         _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_EN_US + [
             'host/bin/mar',
             'host/bin/mbsdiff',
         ],
-    r'^win(32|64)(|-devedition)-nightly$':
+    r'^(linux(|64)|macosx64)-devedition-nightly$':
         _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_EN_US + [
-            "host/bin/mar.exe",
-            "host/bin/mbsdiff.exe",
+            'host/bin/mar',
+            'host/bin/mbsdiff',
+            # TODO Bug 1453033: Sign devedition langpacks
+            'target.langpack.xpi',
+        ],
+    r'^win(32|64)-nightly$':
+        _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_EN_US + [
+            'host/bin/mar.exe',
+            'host/bin/mbsdiff.exe',
+        ],
+    r'^win(32|64)-devedition-nightly$':
+        _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_EN_US + [
+            'host/bin/mar.exe',
+            'host/bin/mbsdiff.exe',
+            # TODO Bug 1453033: Sign devedition langpacks
+            'target.langpack.xpi',
+        ],
+    r'^(linux(|64)|macosx64|win(32|64))-nightly-l10n$': [],
+    r'^(linux(|64)|macosx64|win(32|64))-devedition-nightly-l10n$':
+        [
+            # TODO Bug 1453033: Sign devedition langpacks
+            'target.langpack.xpi',
         ],
-    r'^(linux(|64)|macosx64|win(32|64))(|-devedition)-nightly-l10n$':
-        _DESKTOP_UPSTREAM_ARTIFACTS_UNSIGNED_L10N,
 }
 
 # Until bug 1331141 is fixed, if you are adding any new artifacts here that
@@ -287,12 +296,13 @@ def generate_upstream_artifacts(build_task_ref, build_signing_task_ref,
                 _check_platform_matched_only_one_regex(
                     tasktype, platform, plarform_was_previously_matched_by_regex, platform_regex
                 )
-                upstream_artifacts.append({
-                    "taskId": {"task-reference": ref},
-                    "taskType": tasktype,
-                    "paths": ["{}/{}".format(artifact_prefix, path) for path in paths],
-                    "locale": locale or "en-US",
-                })
+                if paths:
+                    upstream_artifacts.append({
+                        "taskId": {"task-reference": ref},
+                        "taskType": tasktype,
+                        "paths": ["{}/{}".format(artifact_prefix, path) for path in paths],
+                        "locale": locale or "en-US",
+                    })
                 plarform_was_previously_matched_by_regex = platform_regex
 
     return upstream_artifacts

taskcluster/taskgraph/transforms/release_beetmover_signed_addons.py

@@ -0,0 +1,208 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the beetmover task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.transforms.beetmover import craft_release_properties
+from taskgraph.util.attributes import copy_attributes_from_dependent_job
+from taskgraph.util.schema import validate_schema, Schema, optionally_keyed_by, resolve_keyed_by
+from taskgraph.util.scriptworker import (get_beetmover_bucket_scope,
+                                         get_beetmover_action_scope)
+from taskgraph.transforms.task import task_description_schema
+from taskgraph.transforms.release_sign_and_push_langpacks import get_upstream_task_ref
+from voluptuous import Required, Optional
+
+import logging
+import copy
+
+logger = logging.getLogger(__name__)
+
+
+task_description_schema = {str(k): v for k, v in task_description_schema.schema.iteritems()}
+
+
+transforms = TransformSequence()
+
+
+beetmover_description_schema = Schema({
+    # the dependent task (object) for this beetmover job, used to inform beetmover.
+    Required('dependent-task'): object,
+
+    # depname is used in taskref's to identify the taskID of the unsigned things
+    Required('depname', default='build'): basestring,
+
+    # unique label to describe this beetmover task, defaults to {dep.label}-beetmover
+    Optional('label'): basestring,
+
+    # treeherder is allowed here to override any defaults we use for beetmover.  See
+    # taskcluster/taskgraph/transforms/task.py for the schema details, and the
+    # below transforms for defaults of various values.
+    Optional('treeherder'): task_description_schema['treeherder'],
+
+    Required('description'): basestring,
+    Required('worker-type'): optionally_keyed_by('project', basestring),
+    Required('run-on-projects'): [],
+
+    # locale is passed only for l10n beetmoving
+    Optional('locale'): basestring,
+    Optional('shipping-phase'): task_description_schema['shipping-phase'],
+    Optional('shipping-product'): task_description_schema['shipping-product'],
+})
+
+
+@transforms.add
+def set_label(config, jobs):
+    for job in jobs:
+        job['label'] = job['dependent-task'].label.replace(
+            'sign-and-push-langpacks', 'beetmover-signed-langpacks'
+        )
+
+        yield job
+
+
+@transforms.add
+def validate(config, jobs):
+    for job in jobs:
+        validate_schema(
+            beetmover_description_schema, job,
+            "In beetmover ({!r} kind) task for {!r}:".format(config.kind, job['label'])
+        )
+        yield job
+
+
+@transforms.add
+def resolve_keys(config, jobs):
+    for job in jobs:
+        resolve_keyed_by(
+            job, 'worker-type', item_name=job['label'], project=config.params['project']
+        )
+        yield job
+
+
+@transforms.add
+def make_task_description(config, jobs):
+    for job in jobs:
+        dep_job = job['dependent-task']
+        attributes = dep_job.attributes
+
+        treeherder = job.get('treeherder', {})
+        treeherder.setdefault('symbol', 'langpack(BM{})'.format(attributes.get('l10n_chunk', '')))
+        dep_th_platform = dep_job.task.get('extra', {}).get(
+            'treeherder', {}).get('machine', {}).get('platform', '')
+        treeherder.setdefault('platform',
+                              "{}/opt".format(dep_th_platform))
+        treeherder.setdefault('tier', 1)
+        treeherder.setdefault('kind', 'build')
+
+        job['attributes'] = copy_attributes_from_dependent_job(dep_job)
+        job['attributes']['chunk_locales'] = dep_job.attributes['chunk_locales']
+
+        job['description'] = job['description'].format(
+            locales='/'.join(job['attributes']['chunk_locales']),
+            platform=job['attributes']['build_platform']
+        )
+
+        job['scopes'] = [
+            get_beetmover_bucket_scope(config),
+            get_beetmover_action_scope(config),
+        ]
+
+        job['dependencies'] = {
+            str(dep_job.kind): dep_job.label
+        }
+
+        job['run-on-projects'] = dep_job.attributes['run_on_projects']
+        job['treeherder'] = treeherder
+        job['shipping-phase'] = dep_job.attributes['shipping_phase']
+        job['shipping-product'] = dep_job.attributes['shipping_product']
+
+        yield job
+
+
+@transforms.add
+def make_task_worker(config, jobs):
+    for job in jobs:
+        signing_task_ref = get_upstream_task_ref(
+            job, expected_kinds=('release-sign-and-push-langpacks',)
+        )
+
+        job['worker'] = {
+            'implementation': 'beetmover',
+            'release-properties': craft_release_properties(config, job),
+            'upstream-artifacts': generate_upstream_artifacts(
+                signing_task_ref, job['attributes']['chunk_locales']
+            ),
+        }
+
+        yield job
+
+
+def generate_upstream_artifacts(upstream_task_ref, locales):
+    return [{
+        'taskId': {'task-reference': upstream_task_ref},
+        'taskType': 'scriptworker',
+        'locale': locale,
+        'paths': [
+            # addonscript uploads en-US XPI in the en-US folder
+            'public/build/{}/target.langpack.xpi'.format(locale)
+        ],
+    } for locale in locales]
+
+
+@transforms.add
+def strip_unused_data(config, jobs):
+    for job in jobs:
+        del job['dependent-task']
+
+        yield job
+
+
+@transforms.add
+def yield_all_platform_jobs(config, jobs):
+    # Even though langpacks are now platform independent, we keep beetmoving them at old
+    # platform-specific locations. That's why this transform exist
+    for job in jobs:
+        if 'ja-JP-mac' in job['label']:
+            # This locale must not be copied on any other platform than macos
+            yield job
+        else:
+            for platform in ('linux', 'linux64', 'macosx64', 'win32', 'win64'):
+                platform_job = copy.deepcopy(job)
+                if 'ja' in platform_job['attributes']['chunk_locales'] and platform == 'macosx64':
+                    platform_job = _strip_ja_data_from_linux_job(platform_job)
+
+                platform_job = _change_platform_data(platform_job, platform)
+
+                yield platform_job
+
+
+def _strip_ja_data_from_linux_job(platform_job):
+    # Let's take "ja" out the description. This locale is in a substring like "aa/bb/cc/dd", where
+    # "ja" could be any of "aa", "bb", "cc", "dd"
+    platform_job['description'] = platform_job['description'].replace('ja/', '')
+    platform_job['description'] = platform_job['description'].replace('/ja', '')
+
+    platform_job['worker']['upstream-artifacts'] = [
+        artifact
+        for artifact in platform_job['worker']['upstream-artifacts']
+        if artifact['locale'] != 'ja'
+    ]
+
+    return platform_job
+
+
+def _change_platform_data(platform_job, platform):
+    platform_job['attributes']['build_platform'] = platform
+    platform_job['label'] = platform_job['label'].replace('linux64', platform)
+    platform_job['description'] = platform_job['description'].replace('linux64', platform)
+    platform_job['treeherder']['platform'] = platform_job['treeherder']['platform'].replace(
+        'linux64', platform
+    )
+    platform_job['worker']['release-properties']['platform'] = platform
+
+    return platform_job

taskcluster/taskgraph/transforms/release_sign_and_push_langpacks.py

@@ -0,0 +1,175 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+Transform the release-sign-and-push task into an actual task description.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from taskgraph.transforms.base import TransformSequence
+from taskgraph.util.attributes import copy_attributes_from_dependent_job
+from taskgraph.util.schema import validate_schema, Schema, resolve_keyed_by, optionally_keyed_by
+from taskgraph.transforms.task import task_description_schema
+from voluptuous import Any, Required
+
+
+transforms = TransformSequence()
+
+task_description_schema = {str(k): v for k, v in task_description_schema.schema.iteritems()}
+
+
+transforms = TransformSequence()
+
+
+langpack_sign_push_description_schema = Schema({
+    Required('dependent-task'): object,
+    Required('label'): basestring,
+    Required('description'): basestring,
+    Required('worker-type'): optionally_keyed_by('project', basestring),
+    Required('worker'): {
+        Required('implementation'): 'sign-and-push-addons',
+        Required('channel'): optionally_keyed_by('project', Any('listed', 'unlisted')),
+        Required('upstream-artifacts'): None,   # Processed here below
+    },
+
+    Required('run-on-projects'): [],
+    Required('scopes'): optionally_keyed_by('project', [basestring]),
+    Required('shipping-phase'): task_description_schema['shipping-phase'],
+    Required('shipping-product'): task_description_schema['shipping-product'],
+})
+
+
+@transforms.add
+def set_label(config, jobs):
+    for job in jobs:
+        label = 'sign-and-push-langpacks-{}'.format(job['dependent-task'].label)
+        job['label'] = label
+
+        yield job
+
+
+@transforms.add
+def validate(config, jobs):
+    for job in jobs:
+        validate_schema(
+            langpack_sign_push_description_schema, job,
+            'In sign-and-push-langpacks ({} kind) task for {}:'.format(config.kind, job['label'])
+        )
+        yield job
+
+
+@transforms.add
+def resolve_keys(config, jobs):
+    for job in jobs:
+        resolve_keyed_by(
+            job, 'worker-type', item_name=job['label'], project=config.params['project']
+        )
+        resolve_keyed_by(
+            job, 'scopes', item_name=job['label'], project=config.params['project']
+        )
+        resolve_keyed_by(
+            job, 'worker.channel', item_name=job['label'], project=config.params['project']
+        )
+
+        yield job
+
+
+@transforms.add
+def copy_attributes(config, jobs):
+    for job in jobs:
+        dep_job = job['dependent-task']
+        job['attributes'] = copy_attributes_from_dependent_job(dep_job)
+        job['attributes']['chunk_locales'] = dep_job.attributes.get('chunk_locales', ['en-US'])
+
+        yield job
+
+
+@transforms.add
+def filter_out_macos_jobs_but_mac_only_locales(config, jobs):
+    for job in jobs:
+        build_platform = job['dependent-task'].attributes.get('build_platform')
+
+        if build_platform == 'linux64-nightly':
+            yield job
+        elif build_platform == 'macosx64-nightly' and \
+                'ja-JP-mac' in job['attributes']['chunk_locales']:
+            # Other locales of the same job shouldn't be processed
+            job['attributes']['chunk_locales'] = ['ja-JP-mac']
+            job['label'] = job['label'].replace(
+                job['attributes']['l10n_chunk'], 'ja-JP-mac'
+            )
+            yield job
+
+
+@transforms.add
+def make_task_description(config, jobs):
+    for job in jobs:
+        dep_job = job['dependent-task']
+
+        treeherder = job.get('treeherder', {})
+        treeherder.setdefault('symbol', 'langpack(SnP{})'.format(
+            job['attributes'].get('l10n_chunk', '')
+        ))
+        dep_th_platform = dep_job.task.get('extra', {}).get(
+            'treeherder', {}).get('machine', {}).get('platform', '')
+        treeherder.setdefault('platform', '{}/opt'.format(dep_th_platform))
+        treeherder.setdefault('tier', 1)
+        treeherder.setdefault('kind', 'build')
+
+        job['description'] = job['description'].format(
+            locales='/'.join(job['attributes']['chunk_locales']),
+        )
+
+        job['dependencies'] = {
+            str(dep_job.kind): dep_job.label
+        }
+        job['treeherder'] = treeherder
+
+        yield job
+
+
+def generate_upstream_artifacts(upstream_task_ref, locales):
+    return [{
+        'taskId': {'task-reference': upstream_task_ref},
+        'taskType': 'build',
+        'paths': [
+            'public/build{locale}/target.langpack.xpi'.format(
+                locale='' if locale == 'en-US' else '/' + locale
+            )
+            for locale in locales
+        ],
+    }]
+
+
+@transforms.add
+def make_task_worker(config, jobs):
+    for job in jobs:
+        upstream_task_ref = get_upstream_task_ref(job, expected_kinds=('build', 'nightly-l10n'))
+
+        job['worker']['upstream-artifacts'] = generate_upstream_artifacts(
+            upstream_task_ref, job['attributes']['chunk_locales']
+        )
+
+        yield job
+
+
+def get_upstream_task_ref(job, expected_kinds):
+    upstream_tasks = [
+        job_kind
+        for job_kind in job['dependencies'].keys()
+        if job_kind in expected_kinds
+    ]
+
+    if len(upstream_tasks) > 1:
+        raise Exception('Only one dependency expected')
+
+    return '<{}>'.format(upstream_tasks[0])
+
+
+@transforms.add
+def strip_unused_data(config, jobs):
+    for job in jobs:
+        del job['dependent-task']
+
+        yield job

taskcluster/taskgraph/transforms/task.py

@@ -456,7 +456,7 @@ task_description_schema = Schema({
         Required('implementation'): 'beetmover',
 
         # the maximum time to run, in seconds
-        Required('max-run-time'): int,
+        Required('max-run-time', default=600): int,
 
         # locale key, if this is a locale beetmover job
         Optional('locale'): basestring,
@@ -550,6 +550,14 @@ task_description_schema = Schema({
             Required('taskType'): basestring,
             Required('paths'): [basestring],
         }],
+    }, {
+        Required('implementation'): 'sign-and-push-addons',
+        Required('channel'): Any('listed', 'unlisted'),
+        Required('upstream-artifacts'): [{
+            Required('taskId'): taskref_or_string,
+            Required('taskType'): basestring,
+            Required('paths'): [basestring],
+        }],
     }, {
         Required('implementation'): 'shipit',
         Required('release-name'): basestring,
@@ -1099,7 +1107,7 @@ def build_push_apk_payload(config, task, task_def):
 
     task_def['payload'] = {
         'commit': worker['commit'],
-        'upstreamArtifacts':  worker['upstream-artifacts'],
+        'upstreamArtifacts': worker['upstream-artifacts'],
         'google_play_track': worker['google-play-track'],
     }
 
@@ -1125,6 +1133,16 @@ def build_ship_it_payload(config, task, task_def):
     }
 
 
+@payload_builder('sign-and-push-addons')
+def build_sign_and_push_addons_payload(config, task, task_def):
+    worker = task['worker']
+
+    task_def['payload'] = {
+        'channel': worker['channel'],
+        'upstreamArtifacts': worker['upstream-artifacts'],
+    }
+
+
 @payload_builder('treescript')
 def build_treescript_payload(config, task, task_def):
     worker = task['worker']

testing/talos/talos.json

@@ -16,8 +16,12 @@
             "tests": ["tp5o_scroll", "glterrain"],
             "pagesets_name": "tp5n.zip"
         },
-        "g2-e10s": {
-            "tests": ["damp", "tps"],
+        "damp-e10s": {
+            "tests": ["damp"],
+            "pagesets_name": "tp5n.zip"
+        },
+        "tps-e10s": {
+            "tests": ["tps"],
             "pagesets_name": "tp5n.zip"
         },
         "g3-e10s": {

toolkit/content/widgets/button.xml

@@ -372,7 +372,4 @@
     </content>
   </binding>
 
-  <binding id="button-repeat" display="xul:autorepeatbutton"
-           extends="chrome://global/content/bindings/button.xml#button"/>
-
 </bindings>

toolkit/content/xul.css

@@ -106,10 +106,6 @@ button {
   -moz-binding: url("chrome://global/content/bindings/button.xml#button");
 }
 
-button[type="repeat"] {
-  -moz-binding: url("chrome://global/content/bindings/button.xml#button-repeat");
-}
-
 button[type="menu"] {
   -moz-binding: url("chrome://global/content/bindings/button.xml#menu");
 }