--- a/browser/modules/test/browser/browser.ini
+++ b/browser/modules/test/browser/browser.ini
@@ -2,16 +2,17 @@
 support-files =
   head.js
 
 [browser_BrowserUITelemetry_buckets.js]
 [browser_BrowserUITelemetry_defaults.js]
 [browser_BrowserUITelemetry_sidebar.js]
 [browser_BrowserUITelemetry_syncedtabs.js]
 [browser_ContentSearch.js]
+skip-if = (os == "mac" || os == "linux") # Bug 1308343
 support-files =
   contentSearch.js
   contentSearchBadImage.xml
   contentSearchSuggestions.sjs
   contentSearchSuggestions.xml
   !/browser/components/search/test/head.js
   !/browser/components/search/test/testEngine.xml
 [browser_NetworkPrioritizer.js]

--- a/devtools/shared/heapsnapshot/HeapSnapshot.cpp
+++ b/devtools/shared/heapsnapshot/HeapSnapshot.cpp
@@ -1431,18 +1431,17 @@ WriteHeapGraph(JSContext* cx,
   }
 
   return ok;
 }
 
 static unsigned long
 msSinceProcessCreation(const TimeStamp& now)
 {
-  bool ignored;
-  auto duration = now - TimeStamp::ProcessCreation(ignored);
+  auto duration = now - TimeStamp::ProcessCreation();
   return (unsigned long) duration.ToMilliseconds();
 }
 
 /* static */ already_AddRefed<nsIFile>
 HeapSnapshot::CreateUniqueCoreDumpFile(ErrorResult& rv,
                                        const TimeStamp& now,
                                        nsAString& outFilePath,
                                        nsAString& outSnapshotId)

--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -194,16 +194,17 @@
 #include "nsXULAppAPI.h"
 #include "nsDOMNavigationTiming.h"
 #include "nsISecurityUITelemetry.h"
 #include "nsDSURIContentListener.h"
 #include "nsDocShellLoadTypes.h"
 #include "nsDocShellTransferableHooks.h"
 #include "nsICommandManager.h"
 #include "nsIDOMNode.h"
+#include "nsIClassOfService.h"
 #include "nsIDocShellTreeOwner.h"
 #include "nsIHttpChannel.h"
 #include "nsIIDNService.h"
 #include "nsIInputStreamChannel.h"
 #include "nsINestedURI.h"
 #include "nsISHContainer.h"
 #include "nsISHistory.h"
 #include "nsISecureBrowserUI.h"
@@ -3019,19 +3020,17 @@ nsDocShell::PopProfileTimelineMarkers(
   }
 
   return NS_OK;
 }
 
 nsresult
 nsDocShell::Now(DOMHighResTimeStamp* aWhen)
 {
-  bool ignore;
-  *aWhen =
-    (TimeStamp::Now() - TimeStamp::ProcessCreation(ignore)).ToMilliseconds();
+  *aWhen = (TimeStamp::Now() - TimeStamp::ProcessCreation()).ToMilliseconds();
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDocShell::SetWindowDraggingAllowed(bool aValue)
 {
   RefPtr<nsDocShell> parent = GetParentDocshell();
   if (!aValue && mItemType == typeChrome && !parent) {
@@ -11342,16 +11341,27 @@ nsDocShell::DoURILoad(nsIURI* aURI,
     if (IsFrame() && win) {
       nsCOMPtr<Element> frameElement = win->GetFrameElementInternal();
       if (frameElement) {
         timedChannel->SetInitiatorType(frameElement->LocalName());
       }
     }
   }
 
+  // Mark the http channel as UrgentStart for top level document loading
+  // in active tab.
+  if (mIsActive || (mLoadType & (LOAD_CMD_NORMAL | LOAD_CMD_HISTORY))) {
+    if (httpChannel && isTopLevelDoc) {
+      nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(channel));
+      if (cos) {
+        cos->AddClassFlags(nsIClassOfService::UrgentStart);
+      }
+    }
+  }
+
   rv = DoChannelLoad(channel, uriLoader, aBypassClassifier);
 
   //
   // If the channel load failed, we failed and nsIWebProgress just ain't
   // gonna happen.
   //
   if (NS_SUCCEEDED(rv)) {
     if (aDocShell) {

--- a/docshell/base/timeline/AbstractTimelineMarker.cpp
+++ b/docshell/base/timeline/AbstractTimelineMarker.cpp
@@ -60,18 +60,17 @@ AbstractTimelineMarker::SetCurrentTime()
 {
   TimeStamp now = TimeStamp::Now();
   SetCustomTime(now);
 }
 
 void
 AbstractTimelineMarker::SetCustomTime(const TimeStamp& aTime)
 {
-  bool isInconsistent = false;
-  mTime = (aTime - TimeStamp::ProcessCreation(isInconsistent)).ToMilliseconds();
+  mTime = (aTime - TimeStamp::ProcessCreation()).ToMilliseconds();
 }
 
 void
 AbstractTimelineMarker::SetCustomTime(DOMHighResTimeStamp aTime)
 {
   mTime = aTime;
 }
 

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1156,17 +1156,17 @@ nsOuterWindowProxy::className(JSContext 
     return "Window";
 }
 
 void
 nsOuterWindowProxy::finalize(JSFreeOp *fop, JSObject *proxy) const
 {
   nsGlobalWindow* outerWindow = GetOuterWindow(proxy);
   if (outerWindow) {
-    outerWindow->ClearWrapper();
+    outerWindow->ClearWrapper(proxy);
 
     // Ideally we would use OnFinalize here, but it's possible that
     // EnsureScriptEnvironment will later be called on the window, and we don't
     // want to create a new script object in that case. Therefore, we need to
     // write a non-null value that will reliably crash when dereferenced.
     outerWindow->PoisonOuterWindowProxy(proxy);
   }
 }
@@ -1723,17 +1723,17 @@ nsGlobalWindow::~nsGlobalWindow()
                   static_cast<void*>(ToCanonicalSupports(outer)),
                   url.get());
   }
 #endif
 
   MOZ_LOG(gDOMLeakPRLog, LogLevel::Debug, ("DOMWINDOW %p destroyed", this));
 
   if (IsOuterWindow()) {
-    JSObject *proxy = GetWrapperPreserveColor();
+    JSObject *proxy = GetWrapperMaybeDead();
     if (proxy) {
       js::SetProxyExtra(proxy, 0, js::PrivateValue(nullptr));
     }
 
     // An outer window is destroyed with inner windows still possibly
     // alive, iterate through the inner windows and null out their
     // back pointer to this outer, and pull them out of the list of
     // inner windows.
@@ -3942,17 +3942,17 @@ nsGlobalWindow::DispatchDOMEvent(WidgetE
                                            aEvent, aDOMEvent, aPresContext,
                                            aEventStatus);
 }
 
 void
 nsGlobalWindow::PoisonOuterWindowProxy(JSObject *aObject)
 {
   MOZ_ASSERT(IsOuterWindow());
-  if (aObject == GetWrapperPreserveColor()) {
+  if (aObject == GetWrapperMaybeDead()) {
     PoisonWrapper();
   }
 }
 
 nsresult
 nsGlobalWindow::SetArguments(nsIArray *aArguments)
 {
   MOZ_ASSERT(IsOuterWindow());

--- a/dom/base/nsImageLoadingContent.cpp
+++ b/dom/base/nsImageLoadingContent.cpp
@@ -95,18 +95,17 @@ nsImageLoadingContent::nsImageLoadingCon
     mStateChangerDepth(0),
     mCurrentRequestRegistered(false),
     mPendingRequestRegistered(false)
 {
   if (!nsContentUtils::GetImgLoaderForChannel(nullptr, nullptr)) {
     mLoadingEnabled = false;
   }
 
-  bool isInconsistent;
-  mMostRecentRequestChange = TimeStamp::ProcessCreation(isInconsistent);
+  mMostRecentRequestChange = TimeStamp::ProcessCreation();
 }
 
 void
 nsImageLoadingContent::DestroyImageLoadingContent()
 {
   // Cancel our requests so they won't hold stale refs to us
   // NB: Don't ask to discard the images here.
   ClearCurrentRequest(NS_BINDING_ABORTED);

--- a/dom/base/nsWrapperCache.h
+++ b/dom/base/nsWrapperCache.h
@@ -90,22 +90,35 @@ public:
 
   /**
    * Get the cached wrapper.
    *
    * This getter does not change the color of the JSObject meaning that the
    * object returned is not guaranteed to be kept alive past the next CC.
    *
    * This should only be called if you are certain that the return value won't
-   * be passed into a JS API function and that it won't be stored without being
+   * be passed into a JSAPI function and that it won't be stored without being
    * rooted (or otherwise signaling the stored value to the CC).
    */
-  JSObject* GetWrapperPreserveColor() const
+  JSObject* GetWrapperPreserveColor() const;
+
+  /**
+   * Get the cached wrapper.
+   *
+   * This getter does not check whether the wrapper is dead and in the process
+   * of being finalized.
+   *
+   * This should only be called if you really need to see the raw contents of
+   * this cache, for example as part of finalization. Don't store the result
+   * anywhere or pass it into JSAPI functions that may cause the value to
+   * escape.
+   */
+  JSObject* GetWrapperMaybeDead() const
   {
-    return GetWrapperJSObject();
+    return mWrapper;
   }
 
 #ifdef DEBUG
 private:
   static bool HasJSObjectMovedOp(JSObject* aWrapper);
 
 public:
 #endif
@@ -116,24 +129,33 @@ public:
     MOZ_ASSERT(aWrapper, "Use ClearWrapper!");
     MOZ_ASSERT(HasJSObjectMovedOp(aWrapper),
                "Object has not provided the hook to update the wrapper if it is moved");
 
     SetWrapperJSObject(aWrapper);
   }
 
   /**
-   * Clear the wrapper. This should be called from the finalizer for the
-   * wrapper.
+   * Clear the cache.
    */
   void ClearWrapper()
   {
     MOZ_ASSERT(!PreservingWrapper(), "Clearing a preserved wrapper!");
+    SetWrapperJSObject(nullptr);
+  }
 
-    SetWrapperJSObject(nullptr);
+  /**
+   * Clear the cache if it still contains a specific wrapper object. This should
+   * be called from the finalizer for the wrapper.
+   */
+  void ClearWrapper(JSObject* obj)
+  {
+    if (obj == mWrapper) {
+      ClearWrapper();
+    }
   }
 
   /**
    * Update the wrapper if the object it contains is moved.
    *
    * This method must be called from the objectMovedOp class extension hook for
    * any wrapper cached object.
    */
@@ -289,21 +311,16 @@ private:
   friend class nsWindowRoot;
   void SetIsNotDOMBinding()
   {
     MOZ_ASSERT(!mWrapper && !(GetWrapperFlags() & ~WRAPPER_IS_NOT_DOM_BINDING),
                "This flag should be set before creating any wrappers.");
     SetWrapperFlags(WRAPPER_IS_NOT_DOM_BINDING);
   }
 
-  JSObject *GetWrapperJSObject() const
-  {
-    return mWrapper;
-  }
-
   void SetWrapperJSObject(JSObject* aWrapper);
 
   FlagsType GetWrapperFlags() const
   {
     return mFlags & kWrapperFlagsMask;
   }
 
   bool HasWrapperFlag(FlagsType aFlag) const

--- a/dom/base/nsWrapperCacheInlines.h
+++ b/dom/base/nsWrapperCacheInlines.h
@@ -7,16 +7,31 @@
 #ifndef nsWrapperCacheInline_h___
 #define nsWrapperCacheInline_h___
 
 #include "nsWrapperCache.h"
 #include "js/GCAPI.h"
 #include "js/TracingAPI.h"
 
 inline JSObject*
+nsWrapperCache::GetWrapperPreserveColor() const
+{
+  JSObject* obj = mWrapper;
+  if (obj && js::gc::EdgeNeedsSweepUnbarriered(&obj)) {
+    // The object has been found to be dead and is in the process of being
+    // finalized, so don't let the caller see it. As an optimisation, remove it
+    // from the cache so we don't have to do this check in future.
+    const_cast<nsWrapperCache*>(this)->ClearWrapper();
+    return nullptr;
+  }
+  MOZ_ASSERT(obj == mWrapper);
+  return obj;
+}
+
+inline JSObject*
 nsWrapperCache::GetWrapper() const
 {
     JSObject* obj = GetWrapperPreserveColor();
     if (obj) {
       JS::ExposeObjectToActiveJS(obj);
     }
     return obj;
 }

--- a/dom/base/test/browser.ini
+++ b/dom/base/test/browser.ini
@@ -1,14 +1,16 @@
 [DEFAULT]
 support-files =
   audio.ogg
   empty.html
   file_audioLoop.html
   file_audioLoopInIframe.html
+  file_bug902350.html
+  file_bug902350_frame.html
   file_bug1011748_redirect.sjs
   file_bug1011748_OK.sjs
   file_bug1303838.html
   file_bug1303838_target.html
   file_bug1303838_with_iframe.html
   file_messagemanager_unload.html
   file_pluginAudio.html
   file_use_counter_outer.html

--- a/dom/base/test/browser_bug902350.js
+++ b/dom/base/test/browser_bug902350.js
@@ -1,15 +1,15 @@
 /*
  * Mixed Content Block frame navigates for target="_top" - Test for Bug 902350
  */
 
 
 const PREF_ACTIVE = "security.mixed_content.block_active_content";
-const gHttpTestRoot = "https://example.com/tests/dom/base/test/";
+const gHttpTestRoot = "https://example.com/browser/dom/base/test/";
 var origBlockActive;
 var gTestBrowser = null;
 
 registerCleanupFunction(function() {
   // Set preferences back to their original values
   Services.prefs.setBoolPref(PREF_ACTIVE, origBlockActive);
 });
 

--- a/dom/base/test/file_bug902350.html
+++ b/dom/base/test/file_bug902350.html
@@ -6,14 +6,14 @@ https://bugzilla.mozilla.org/show_bug.cg
 -->
 <head>
   <meta charset="utf-8">
   <title>Test for Bug 902350</title>
 </head>
 
 <body>
   <div id="framediv">
-    <iframe src="https://example.com/tests/dom/base/test/file_bug902350_frame.html" id="testing_frame"></iframe>
+    <iframe src="https://example.com/browser/dom/base/test/file_bug902350_frame.html" id="testing_frame"></iframe>
   </div>
 </body>
 </html>
 
 

--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -116,18 +116,16 @@ support-files =
   file_bug708620-2.html
   file_bug708620.html
   file_bug769117.html
   file_bug782342.txt
   file_bug787778.sjs
   file_bug804395.jar
   file_bug869432.eventsource
   file_bug869432.eventsource^headers^
-  file_bug902350.html
-  file_bug902350_frame.html
   file_bug907892.html
   file_bug945152.jar
   file_bug1274806.html
   file_domwindowutils_animation.html
   file_general_document.html
   file_htmlserializer_1.html
   file_htmlserializer_1_bodyonly.html
   file_htmlserializer_1_format.html

--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -1313,28 +1313,30 @@ GetUseXBLScope(T* aParentObject)
 inline bool
 GetUseXBLScope(const ParentObject& aParentObject)
 {
   return aParentObject.mUseXBLScope;
 }
 
 template<class T>
 inline void
-ClearWrapper(T* p, nsWrapperCache* cache)
+ClearWrapper(T* p, nsWrapperCache* cache, JSObject* obj)
 {
-  cache->ClearWrapper();
+  JS::AutoAssertGCCallback inCallback;
+  cache->ClearWrapper(obj);
 }
 
 template<class T>
 inline void
-ClearWrapper(T* p, void*)
+ClearWrapper(T* p, void*, JSObject* obj)
 {
+  JS::AutoAssertGCCallback inCallback;
   nsWrapperCache* cache;
   CallQueryInterface(p, &cache);
-  ClearWrapper(p, cache);
+  ClearWrapper(p, cache, obj);
 }
 
 template<class T>
 inline void
 UpdateWrapper(T* p, nsWrapperCache* cache, JSObject* obj, const JSObject* old)
 {
   JS::AutoAssertGCCallback inCallback;
   cache->UpdateWrapper(obj, old);

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1647,40 +1647,41 @@ class CGAddPropertyHook(CGAbstractClassH
             // obviously can't preserve if we're not initialized.
             if (self && self->GetWrapperPreserveColor()) {
               PreserveWrapper(self);
             }
             return true;
             """)
 
 
-def finalizeHook(descriptor, hookName, freeOp):
+def finalizeHook(descriptor, hookName, freeOp, obj):
     finalize = ""
     if descriptor.wrapperCache:
-        finalize += "ClearWrapper(self, self);\n"
+        finalize += "ClearWrapper(self, self, %s);\n" % obj
     if descriptor.interface.getExtendedAttribute('OverrideBuiltins'):
         finalize += "self->mExpandoAndGeneration.expando = JS::UndefinedValue();\n"
     if descriptor.isGlobal():
-        finalize += "mozilla::dom::FinalizeGlobal(CastToJSFreeOp(%s), obj);\n" % freeOp
+        finalize += "mozilla::dom::FinalizeGlobal(CastToJSFreeOp(%s), %s);\n" % (freeOp, obj)
     finalize += ("AddForDeferredFinalization<%s>(self);\n" %
                  descriptor.nativeType)
     return CGIfWrapper(CGGeneric(finalize), "self")
 
 
 class CGClassFinalizeHook(CGAbstractClassHook):
     """
     A hook for finalize, used to release our native object.
     """
     def __init__(self, descriptor):
         args = [Argument('js::FreeOp*', 'fop'), Argument('JSObject*', 'obj')]
         CGAbstractClassHook.__init__(self, descriptor, FINALIZE_HOOK_NAME,
                                      'void', args)
 
     def generate_code(self):
-        return finalizeHook(self.descriptor, self.name, self.args[0].name).define()
+        return finalizeHook(self.descriptor, self.name,
+                            self.args[0].name, self.args[1].name).define()
 
 
 class CGClassObjectMovedHook(CGAbstractClassHook):
     """
     A hook for objectMovedOp, used to update the wrapper cache when an object it
     is holding moves.
     """
     def __init__(self, descriptor):
@@ -12222,17 +12223,18 @@ class CGDOMJSProxyHandler_finalize(Class
         args = [Argument('JSFreeOp*', 'fop'), Argument('JSObject*', 'proxy')]
         ClassMethod.__init__(self, "finalize", "void", args,
                              virtual=True, override=True, const=True)
         self.descriptor = descriptor
 
     def getBody(self):
         return (("%s* self = UnwrapPossiblyNotInitializedDOMObject<%s>(proxy);\n" %
                  (self.descriptor.nativeType, self.descriptor.nativeType)) +
-                finalizeHook(self.descriptor, FINALIZE_HOOK_NAME, self.args[0].name).define())
+                finalizeHook(self.descriptor, FINALIZE_HOOK_NAME,
+                             self.args[0].name, self.args[1].name).define())
 
 
 class CGDOMJSProxyHandler_getElements(ClassMethod):
     def __init__(self, descriptor):
         assert descriptor.supportsIndexedProperties()
 
         args = [Argument('JSContext*', 'cx'),
                 Argument('JS::Handle<JSObject*>', 'proxy'),

--- a/dom/bindings/SimpleGlobalObject.cpp
+++ b/dom/bindings/SimpleGlobalObject.cpp
@@ -41,16 +41,17 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsIGlobalObject)
 NS_INTERFACE_MAP_END
 
 static void
 SimpleGlobal_finalize(js::FreeOp *fop, JSObject *obj)
 {
   SimpleGlobalObject* globalObject =
     static_cast<SimpleGlobalObject*>(JS_GetPrivate(obj));
+  globalObject->ClearWrapper(obj);
   NS_RELEASE(globalObject);
 }
 
 static void
 SimpleGlobal_moved(JSObject *obj, const JSObject *old)
 {
   SimpleGlobalObject* globalObject =
     static_cast<SimpleGlobalObject*>(JS_GetPrivate(obj));

--- a/dom/bindings/SimpleGlobalObject.h
+++ b/dom/bindings/SimpleGlobalObject.h
@@ -82,17 +82,17 @@ private:
   SimpleGlobalObject(JSObject *global, GlobalType type)
     : mType(type)
   {
     SetWrapper(global);
   }
 
   virtual ~SimpleGlobalObject()
   {
-    ClearWrapper();
+    MOZ_ASSERT(!GetWrapperMaybeDead());
   }
 
   const GlobalType mType;
 };
 
 } // namespace dom
 } // namespace mozilla
 

--- a/dom/html/HTMLCanvasElement.cpp
+++ b/dom/html/HTMLCanvasElement.cpp
@@ -1468,16 +1468,21 @@ HTMLCanvasElement::InvalidateFromAsyncCa
   }
 
   element->InvalidateCanvasContent(nullptr);
 }
 
 void
 HTMLCanvasElement::StartVRPresentation()
 {
+  if (GetCurrentContextType() != CanvasContextType::WebGL1 &&
+      GetCurrentContextType() != CanvasContextType::WebGL2) {
+    return;
+  }
+
   WebGLContext* webgl = static_cast<WebGLContext*>(GetContextAtIndex(0));
   if (!webgl) {
     return;
   }
 
   if (!webgl->StartVRPresentation()) {
     return;
   }

--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -424,34 +424,39 @@ NS_IMPL_ISUPPORTS(UploadLastDir::Content
 NS_IMETHODIMP
 UploadLastDir::ContentPrefCallback::HandleCompletion(uint16_t aReason)
 {
   nsCOMPtr<nsIFile> localFile;
   nsAutoString prefStr;
 
   if (aReason == nsIContentPrefCallback2::COMPLETE_ERROR || !mResult) {
     prefStr = Preferences::GetString("dom.input.fallbackUploadDir");
-    if (prefStr.IsEmpty()) {
-      // If no custom directory was set through the pref, default to
-      // "desktop" directory for each platform.
-      NS_GetSpecialDirectory(NS_OS_DESKTOP_DIR, getter_AddRefs(localFile));
-    }
-  }
-
-  if (!localFile) {
-    if (prefStr.IsEmpty() && mResult) {
-      nsCOMPtr<nsIVariant> pref;
-      mResult->GetValue(getter_AddRefs(pref));
-      pref->GetAsAString(prefStr);
-    }
+  }
+
+  if (prefStr.IsEmpty() && mResult) {
+    nsCOMPtr<nsIVariant> pref;
+    mResult->GetValue(getter_AddRefs(pref));
+    pref->GetAsAString(prefStr);
+  }
+
+  if (!prefStr.IsEmpty()) {
     localFile = do_CreateInstance(NS_LOCAL_FILE_CONTRACTID);
-    localFile->InitWithPath(prefStr);
-  }
-
-  mFilePicker->SetDisplayDirectory(localFile);
+    if (localFile && NS_WARN_IF(NS_FAILED(localFile->InitWithPath(prefStr)))) {
+      localFile = nullptr;
+    }
+  }
+
+  if (localFile) {
+    mFilePicker->SetDisplayDirectory(localFile);
+  } else {
+    // If no custom directory was set through the pref, default to
+    // "desktop" directory for each platform.
+    mFilePicker->SetDisplaySpecialDirectory(NS_LITERAL_STRING(NS_OS_DESKTOP_DIR));
+  }
+
   mFilePicker->Open(mFpCallback);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 UploadLastDir::ContentPrefCallback::HandleResult(nsIContentPref* pref)
 {
   mResult = pref;

--- a/dom/html/test/test_filepicker_default_directory.html
+++ b/dom/html/test/test_filepicker_default_directory.html
@@ -42,25 +42,28 @@ var MockFilePicker = SpecialPowers.MockF
 MockFilePicker.init(window);
 
 // need to show the MockFilePicker so .displayDirectory gets set
 var f = document.getElementById("f");
 f.focus();
 
 var testIndex = 0;
 var tests = [
-  ["", defaultUploadDirectory.path],
-  [customUploadDirectory.path, customUploadDirectory.path]
+  ["", null, "Desk"],
+  [customUploadDirectory.path, customUploadDirectory.path, ""]
 ]
 
 MockFilePicker.showCallback = function(filepicker) {
-  info(SpecialPowers.wrap(MockFilePicker).displayDirectory.path);
+  if (tests[testIndex][1] === null) {
+    is(SpecialPowers.wrap(MockFilePicker).displayDirectory, null, "DisplayDirectory is null");
+  } else {
+    is(SpecialPowers.wrap(MockFilePicker).displayDirectory.path, tests[testIndex][1], "DisplayDirectory matches the path");
+  }
 
-  is(SpecialPowers.wrap(MockFilePicker).displayDirectory.path,
-  tests[testIndex][1]);
+  is(SpecialPowers.wrap(MockFilePicker).displaySpecialDirectory, tests[testIndex][2], "DisplaySpecialDirectory matches the path");
 
   if (++testIndex == tests.length) {
     MockFilePicker.cleanup();
     SimpleTest.finish();
   } else {
     launchNextTest();
   }
 }

--- a/dom/ipc/FilePickerParent.cpp
+++ b/dom/ipc/FilePickerParent.cpp
@@ -255,16 +255,17 @@ FilePickerParent::CreateFilePicker()
 mozilla::ipc::IPCResult
 FilePickerParent::RecvOpen(const int16_t& aSelectedType,
                            const bool& aAddToRecentDocs,
                            const nsString& aDefaultFile,
                            const nsString& aDefaultExtension,
                            InfallibleTArray<nsString>&& aFilters,
                            InfallibleTArray<nsString>&& aFilterNames,
                            const nsString& aDisplayDirectory,
+                           const nsString& aDisplaySpecialDirectory,
                            const nsString& aOkButtonLabel)
 {
   if (!CreateFilePicker()) {
     Unused << Send__delete__(this, void_t(), nsIFilePicker::returnCancel);
     return IPC_OK();
   }
 
   mFilePicker->SetAddToRecentDocs(aAddToRecentDocs);
@@ -279,16 +280,18 @@ FilePickerParent::RecvOpen(const int16_t
   mFilePicker->SetOkButtonLabel(aOkButtonLabel);
 
   if (!aDisplayDirectory.IsEmpty()) {
     nsCOMPtr<nsIFile> localFile = do_CreateInstance(NS_LOCAL_FILE_CONTRACTID);
     if (localFile) {
       localFile->InitWithPath(aDisplayDirectory);
       mFilePicker->SetDisplayDirectory(localFile);
     }
+  } else if (!aDisplaySpecialDirectory.IsEmpty()) {
+    mFilePicker->SetDisplaySpecialDirectory(aDisplaySpecialDirectory);
   }
 
   mCallback = new FilePickerShownCallback(this);
 
   mFilePicker->Open(mCallback);
   return IPC_OK();
 }
 

--- a/dom/ipc/FilePickerParent.h
+++ b/dom/ipc/FilePickerParent.h
@@ -47,16 +47,17 @@ class FilePickerParent : public PFilePic
 
   virtual mozilla::ipc::IPCResult RecvOpen(const int16_t& aSelectedType,
                                            const bool& aAddToRecentDocs,
                                            const nsString& aDefaultFile,
                                            const nsString& aDefaultExtension,
                                            InfallibleTArray<nsString>&& aFilters,
                                            InfallibleTArray<nsString>&& aFilterNames,
                                            const nsString& aDisplayDirectory,
+                                           const nsString& aDisplaySpecialDirectory,
                                            const nsString& aOkButtonLabel) override;
 
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
 
   class FilePickerShownCallback : public nsIFilePickerShownCallback
   {
   public:
     explicit FilePickerShownCallback(FilePickerParent* aFilePickerParent)

--- a/dom/ipc/PFilePicker.ipdl
+++ b/dom/ipc/PFilePicker.ipdl
@@ -36,16 +36,17 @@ union MaybeInputData
 
 protocol PFilePicker
 {
   manager PBrowser;
 
 parent:
     async Open(int16_t selectedType, bool addToRecentDocs, nsString defaultFile,
                nsString defaultExtension, nsString[] filters, nsString[] filterNames,
-               nsString displayDirectory, nsString okButtonLabel);
+               nsString displayDirectory, nsString displaySpecialDirectory,
+               nsString okButtonLabel);
 
 child:
     async __delete__(MaybeInputData data, int16_t result);
 };
 
 } // namespace dom
 } // namespace mozilla

--- a/dom/quota/ActorsParent.cpp
+++ b/dom/quota/ActorsParent.cpp
@@ -14,16 +14,17 @@
 #include "nsIFileStreams.h"
 #include "nsIObserverService.h"
 #include "nsIPermissionManager.h"
 #include "nsIPrincipal.h"
 #include "nsIRunnable.h"
 #include "nsISimpleEnumerator.h"
 #include "nsIScriptObjectPrincipal.h"
 #include "nsIScriptSecurityManager.h"
+#include "nsISupportsPrimitives.h"
 #include "nsITimer.h"
 #include "nsIURI.h"
 #include "nsPIDOMWindow.h"
 
 #include <algorithm>
 #include "GeckoProfiler.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/BasePrincipal.h"
@@ -365,16 +366,33 @@ public:
   }
 
   NS_INLINE_DECL_REFCOUNTING(DirectoryLockImpl)
 
 private:
   ~DirectoryLockImpl();
 };
 
+class QuotaObject::StoragePressureRunnable final
+  : public Runnable
+{
+  const uint64_t mUsage;
+
+public:
+  explicit StoragePressureRunnable(uint64_t aUsage)
+    : mUsage(aUsage)
+  { }
+
+private:
+  ~StoragePressureRunnable()
+  { }
+
+  NS_DECL_NSIRUNNABLE
+};
+
 class QuotaManager::CreateRunnable final
   : public BackgroundThreadObject
   , public Runnable
 {
   nsTArray<nsCOMPtr<nsIRunnable>> mCallbacks;
   nsString mBaseDirPath;
   RefPtr<QuotaManager> mManager;
   nsresult mResultCode;
@@ -2849,16 +2867,40 @@ ShutdownObserver::Observe(nsISupports* a
 
   return NS_OK;
 }
 
 /*******************************************************************************
  * Quota object
  ******************************************************************************/
 
+NS_IMETHODIMP
+QuotaObject::
+StoragePressureRunnable::Run()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsCOMPtr<nsIObserverService> obsSvc = mozilla::services::GetObserverService();
+  if (NS_WARN_IF(!obsSvc)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsISupportsPRUint64> wrapper =
+    do_CreateInstance(NS_SUPPORTS_PRUINT64_CONTRACTID);
+  if (NS_WARN_IF(!wrapper)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  wrapper->SetData(mUsage);
+
+  obsSvc->NotifyObservers(wrapper, "QuotaManager::StoragePressure", u"");
+
+  return NS_OK;
+}
+
 void
 QuotaObject::AddRef()
 {
   QuotaManager* quotaManager = QuotaManager::Get();
   if (!quotaManager) {
     NS_ERROR("Null quota manager, this shouldn't happen, possible leak!");
 
     ++mRefCnt;
@@ -2989,18 +3031,24 @@ QuotaObject::MaybeUpdateSize(int64_t aSi
     // This will block the thread without holding the lock while waitting.
 
     AutoTArray<RefPtr<DirectoryLockImpl>, 10> locks;
 
     uint64_t sizeToBeFreed =
       quotaManager->LockedCollectOriginsForEviction(delta, locks);
 
     if (!sizeToBeFreed) {
-      // XXX prompt for asking to delete persistent origins if there is any
-      // persistent origin.
+      MutexAutoUnlock autoUnlock(quotaManager->mQuotaMutex);
+
+      // Notify pressure event.
+      RefPtr<StoragePressureRunnable> storagePressureRunnable =
+        new StoragePressureRunnable(quotaManager->mTemporaryStorageUsage);
+
+      MOZ_ALWAYS_SUCCEEDS(NS_DispatchToMainThread(storagePressureRunnable));
+
       return false;
     }
 
     NS_ASSERTION(sizeToBeFreed >= delta, "Huh?");
 
     {
       MutexAutoUnlock autoUnlock(quotaManager->mQuotaMutex);
 

--- a/dom/quota/QuotaObject.h
+++ b/dom/quota/QuotaObject.h
@@ -18,16 +18,18 @@ BEGIN_QUOTA_NAMESPACE
 class OriginInfo;
 class QuotaManager;
 
 class QuotaObject
 {
   friend class OriginInfo;
   friend class QuotaManager;
 
+  class StoragePressureRunnable;
+
 public:
   void
   AddRef();
 
   void
   Release();
 
   const nsAString&

--- a/dom/vr/test/mochitest.ini
+++ b/dom/vr/test/mochitest.ini
@@ -1,15 +1,17 @@
 [DEFAULT]
 support-files =
   VRSimulationDriver.js
   requestPresent.js
   runVRTest.js
   WebVRHelpers.js
 
+[test_vrDisplay_canvas2d.html]
+skip-if = (os != "win" && release_or_beta) # Enable Linux after Bug 1310655
 [test_vrDisplay_exitPresent.html]
 skip-if = (os != "win" && release_or_beta) # Enable Linux after Bug 1310655
 [test_vrDisplay_getFrameData.html]
 skip-if = (os != "win" && release_or_beta) # Enable Linux after Bug 1310655
 [test_vrDisplay_onvrdisplaydeactivate_crosscontent.html]
 skip-if = true
 [test_vrDisplay_requestPresent.html]
 skip-if = true

new file mode 100644
--- /dev/null
+++ b/dom/vr/test/test_vrDisplay_canvas2d.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>VRDisplay Canvas2D</title>
+    <meta name="timeout" content="long"/>
+    <meta http-equiv="Content-type" content="text/html;charset=UTF-8">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="runVRTest.js"></script>
+  </head>
+  <body>
+    <script>
+      var vrDisplay;
+
+      function requestPresentTest() {
+        async_test(function (test) {
+          vrDisplay.requestAnimationFrame(callback);
+
+          function callback() {
+            vrDisplay.resetPose();
+            vrDisplay.getLayers();
+            vrDisplay.submitFrame();
+            vrDisplay.getEyeParameters("right");
+            test.done();
+          }
+        }, "Finish WebVR Canvas2D requestPresentTest.");
+      }
+
+      function startTest() {
+        promise_test((test) => {
+          var canvas = document.createElement('canvas');
+          (document.body || document.documentElement).appendChild(canvas);
+          var context = canvas.getContext('2d');
+          var img = document.createElement('img');
+          img.src = "data:image/gif;base64,R0lGODlhAQABAAAAACw=";
+
+          return navigator.getVRDisplays().then((displays) => {
+            assert_equals(displays.length, 1, "displays.length must be one after attach.");
+            vrDisplay = displays[0];
+            var frameData = new VRFrameData();
+            return vrDisplay.requestPresent([{source: canvas}]).then(() => {
+              requestPresentTest();
+            });
+          });
+        }, "Finish running WebVR Canvas2D test.");
+      }
+
+      runVRTest(startTest);
+    </script>
+  </body>
+</html>
\ No newline at end of file

--- a/dom/vr/test/test_vrDisplay_exitPresent.html
+++ b/dom/vr/test/test_vrDisplay_exitPresent.html
@@ -13,17 +13,16 @@
       function testExitPresentOnOtherIframe(content) {
           return content.navigator.getVRDisplays().then((displays) => {
             content.vrDisplay = displays[0];
             return content.vrDisplay.exitPresent();
         });
       }
       var initVRPresentation = function(content) {
             return content.navigator.getVRDisplays().then((displays) => {
-            console.log("GetVRDisplay!!");
             content.vrDisplay = displays[0];
             content.canvas = content.document.createElement("canvas");
             content.canvas.id = "vrCanvas";
             return content.vrDisplay.requestPresent([{source:content.canvas}]);
           });
       }
       function startTest() {
         var ifr1 = document.getElementById("iframe1");

--- a/dom/vr/test/test_vrDisplay_getFrameData.html
+++ b/dom/vr/test/test_vrDisplay_getFrameData.html
@@ -107,17 +107,17 @@
                   assert_true(checkValueInFloat32Array(pose1.angularVelocity,
                                                        pose2.angularVelocity),
                               "pose.angularVelocity at a frame should be equal.");
 
                   assert_true(checkValueInFloat32Array(pose1.angularAcceleration,
                                                        pose2.angularAcceleration),
                               "pose.angularAcceleration at a frame should be equal.");
                   test.done();
-                };
+                }
               });
             }, "WebVR returns the same frameData within a frame fulfilled");
           }
 
           function insertNewFrameData() {
             var poseOrient = new Float32Array([-0.208, -0.017, 0.055, -0.930]);
             var posePos = new Float32Array([-0.261, 0.036, -0.150]);
             var poseAngVel = new Float32Array([0.018, -0.001, -0.003]);

--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -249,18 +249,17 @@ CrashStatsLogForwarder::UpdateStringsVec
   mIndex += 1;
   MOZ_ASSERT(mIndex >= 0);
 
   // index will count 0, 1, 2, ..., max-1, 1, 2, ..., max-1, 1, 2, ...
   int32_t index = mIndex ? (mIndex-1) % (mMaxCapacity-1) + 1 : 0;
   MOZ_ASSERT(index >= 0 && index < (int32_t)mMaxCapacity);
   MOZ_ASSERT(index <= mIndex && index <= (int32_t)mBuffer.size());
 
-  bool ignored;
-  double tStamp = (TimeStamp::NowLoRes()-TimeStamp::ProcessCreation(ignored)).ToSecondsSigDigits();
+  double tStamp = (TimeStamp::NowLoRes() - TimeStamp::ProcessCreation()).ToSecondsSigDigits();
 
   // Checking for index >= mBuffer.size(), rather than index == mBuffer.size()
   // just out of paranoia, but we know index <= mBuffer.size().
   LoggingRecordEntry newEntry(mIndex,aString,tStamp);
   if (index >= static_cast<int32_t>(mBuffer.size())) {
     mBuffer.push_back(newEntry);
   } else {
     mBuffer[index] = newEntry;

--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -43,28 +43,26 @@ class imgCacheEntry
 public:
   imgCacheEntry(imgLoader* loader, imgRequest* request,
                 bool aForcePrincipalCheck);
   ~imgCacheEntry();
 
   nsrefcnt AddRef()
   {
     NS_PRECONDITION(int32_t(mRefCnt) >= 0, "illegal refcnt");
-    MOZ_ASSERT(_mOwningThread.GetThread() == PR_GetCurrentThread(),
-      "imgCacheEntry addref isn't thread-safe!");
+    NS_ASSERT_OWNINGTHREAD(imgCacheEntry);
     ++mRefCnt;
     NS_LOG_ADDREF(this, mRefCnt, "imgCacheEntry", sizeof(*this));
     return mRefCnt;
   }
 
   nsrefcnt Release()
   {
     NS_PRECONDITION(0 != mRefCnt, "dup release");
-    MOZ_ASSERT(_mOwningThread.GetThread() == PR_GetCurrentThread(),
-      "imgCacheEntry release isn't thread-safe!");
+    NS_ASSERT_OWNINGTHREAD(imgCacheEntry);
     --mRefCnt;
     NS_LOG_RELEASE(this, mRefCnt, "imgCacheEntry");
     if (mRefCnt == 0) {
       mRefCnt = 1; /* stabilize */
       delete this;
       return 0;
     }
     return mRefCnt;

--- a/ipc/chromium/src/chrome/common/ipc_channel_win.cc
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
@@ -19,17 +19,17 @@
 #include "mozilla/ipc/ProtocolUtils.h"
 
 // ChannelImpl is used on the IPC thread, but constructed on a different thread,
 // so it has to hold the nsAutoOwningThread as a pointer, and we need a slightly
 // different macro.
 #ifdef DEBUG
 #define ASSERT_OWNINGTHREAD(_class) \
   if (nsAutoOwningThread* owningThread = _mOwningThread.get()) {               \
-    NS_CheckThreadSafe(owningThread->GetThread(), #_class " not thread-safe"); \
+    owningThread->AssertOwnership(#_class " not thread-safe"); \
   }
 #else
 #define ASSERT_OWNINGTHREAD(_class) ((void)0)
 #endif
 
 namespace IPC {
 //------------------------------------------------------------------------------
 

--- a/ipc/mscom/InterceptorLog.cpp
+++ b/ipc/mscom/InterceptorLog.cpp
@@ -253,18 +253,17 @@ Logger::VariantToString(const VARIANT& a
     }
   }
 }
 
 /* static */ double
 Logger::GetElapsedTime()
 {
   TimeStamp ts = TimeStamp::Now();
-  bool inconsistent;
-  TimeDuration duration = ts - TimeStamp::ProcessCreation(inconsistent);
+  TimeDuration duration = ts - TimeStamp::ProcessCreation();
   return duration.ToMicroseconds();
 }
 
 void
 Logger::LogQI(HRESULT aResult, IUnknown* aTarget, REFIID aIid, IUnknown* aInterface)
 {
   if (FAILED(aResult)) {
     return;

--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -496,16 +496,40 @@ JavaScriptShared::ConvertID(const JSIID&
     to->m3[3] = from.m3_3();
     to->m3[4] = from.m3_4();
     to->m3[5] = from.m3_5();
     to->m3[6] = from.m3_6();
     to->m3[7] = from.m3_7();
 }
 
 JSObject*
+JavaScriptShared::findCPOWById(const ObjectId& objId)
+{
+    JSObject* obj = findCPOWByIdPreserveColor(objId);
+    if (obj)
+        JS::ExposeObjectToActiveJS(obj);
+    return obj;
+}
+
+JSObject*
+JavaScriptShared::findCPOWByIdPreserveColor(const ObjectId& objId)
+{
+    JSObject* obj = cpows_.findPreserveColor(objId);
+    if (!obj)
+        return nullptr;
+
+    if (js::gc::EdgeNeedsSweepUnbarriered(&obj)) {
+        cpows_.remove(objId);
+        return nullptr;
+    }
+
+    return obj;
+}
+
+JSObject*
 JavaScriptShared::findObjectById(JSContext* cx, const ObjectId& objId)
 {
     RootedObject obj(cx, objects_.find(objId));
     if (!obj) {
         JS_ReportErrorASCII(cx, "operation not possible on dead CPOW");
         return nullptr;
     }
 

--- a/js/ipc/JavaScriptShared.h
+++ b/js/ipc/JavaScriptShared.h
@@ -168,24 +168,24 @@ class JavaScriptShared : public CPOWMana
     bool convertGeckoStringToId(JSContext* cx, const nsString& from, JS::MutableHandleId id);
 
     virtual bool toObjectVariant(JSContext* cx, JSObject* obj, ObjectVariant* objVarp) = 0;
     virtual JSObject* fromObjectVariant(JSContext* cx, const ObjectVariant& objVar) = 0;
 
     static void ConvertID(const nsID& from, JSIID* to);
     static void ConvertID(const JSIID& from, nsID* to);
 
-    JSObject* findCPOWById(const ObjectId& objId) {
-        return cpows_.find(objId);
-    }
+    JSObject* findCPOWById(const ObjectId& objId);
+    JSObject* findCPOWByIdPreserveColor(const ObjectId& objId);
     JSObject* findObjectById(JSContext* cx, const ObjectId& objId);
 
 #ifdef DEBUG
     bool hasCPOW(const ObjectId& objId, const JSObject* obj) {
-        return cpows_.has(objId, obj);
+        MOZ_ASSERT(obj);
+        return findCPOWByIdPreserveColor(objId) == obj;
     }
 #endif
 
     static bool LoggingEnabled() { return sLoggingEnabled; }
     static bool StackLoggingEnabled() { return sStackLoggingEnabled; }
 
     friend class Logging;
 

--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -914,19 +914,22 @@ CPOWProxyHandler::isConstructor(JSObject
 {
     AuxCPOWData* aux = AuxCPOWDataOf(proxy);
     return aux->isConstructor;
 }
 
 void
 WrapperOwner::drop(JSObject* obj)
 {
-    ObjectId objId = idOf(obj);
+    // The association may have already been swept from the table but if it's
+    // there then remove it.
+    ObjectId objId = idOfUnchecked(obj);
+    if (cpows_.findPreserveColor(objId) == obj)
+        cpows_.remove(objId);
 
-    cpows_.remove(objId);
     if (active())
         Unused << SendDropObject(objId);
     decref();
 }
 
 void
 WrapperOwner::updatePointer(JSObject* obj, const JSObject* old)
 {

--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -651,37 +651,60 @@ ExposeGCThingToActiveJS(JS::GCCellPtr th
     if (IsIncrementalBarrierNeededOnTenuredGCThing(thing))
         JS::IncrementalReadBarrier(thing);
     else if (js::gc::detail::TenuredCellIsMarkedGray(thing.asCell()))
         JS::UnmarkGrayGCThingRecursively(thing);
 
     MOZ_ASSERT(!js::gc::detail::TenuredCellIsMarkedGray(thing.asCell()));
 }
 
+template <typename T>
+extern JS_PUBLIC_API(bool)
+EdgeNeedsSweepUnbarrieredSlow(T* thingp);
+
+static MOZ_ALWAYS_INLINE bool
+EdgeNeedsSweepUnbarriered(JSObject** objp)
+{
+    // This function does not handle updating nursery pointers. Raw JSObject
+    // pointers should be updated separately or replaced with
+    // JS::Heap<JSObject*> which handles this automatically.
+    MOZ_ASSERT(!JS::CurrentThreadIsHeapMinorCollecting());
+    if (IsInsideNursery(reinterpret_cast<Cell*>(*objp)))
+        return false;
+
+    auto zone = JS::shadow::Zone::asShadowZone(detail::GetGCThingZone(uintptr_t(*objp)));
+    if (!zone->isGCSweepingOrCompacting())
+        return false;
+
+    return EdgeNeedsSweepUnbarrieredSlow(objp);
+}
+
 } /* namespace gc */
 } /* namespace js */
 
 namespace JS {
 
 /*
  * This should be called when an object that is marked gray is exposed to the JS
  * engine (by handing it to running JS code or writing it into live JS
  * data). During incremental GC, since the gray bits haven't been computed yet,
  * we conservatively mark the object black.
  */
 static MOZ_ALWAYS_INLINE void
 ExposeObjectToActiveJS(JSObject* obj)
 {
     MOZ_ASSERT(obj);
+    MOZ_ASSERT(!js::gc::EdgeNeedsSweepUnbarrieredSlow(&obj));
     js::gc::ExposeGCThingToActiveJS(GCCellPtr(obj));
 }
 
 static MOZ_ALWAYS_INLINE void
 ExposeScriptToActiveJS(JSScript* script)
 {
+    MOZ_ASSERT(!js::gc::EdgeNeedsSweepUnbarrieredSlow(&script));
     js::gc::ExposeGCThingToActiveJS(GCCellPtr(script));
 }
 
 /*
  * Internal to Firefox.
  *
  * Note: this is not related to the PokeGC in nsJSEnvironment.
  */

--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -96,29 +96,39 @@ const uint32_t DefaultNurseryBytes = 16 
 
 /* Default maximum heap size in bytes to pass to JS_NewRuntime(). */
 const uint32_t DefaultHeapMaxBytes = 32 * 1024 * 1024;
 
 namespace shadow {
 
 struct Zone
 {
+    enum GCState : uint8_t {
+        NoGC,
+        Mark,
+        MarkGray,
+        Sweep,
+        Finished,
+        Compact
+    };
+
   protected:
     JSRuntime* const runtime_;
     JSTracer* const barrierTracer_;     // A pointer to the JSRuntime's |gcMarker|.
-
-  public:
     bool needsIncrementalBarrier_;
+    GCState gcState_;
 
     Zone(JSRuntime* runtime, JSTracer* barrierTracerArg)
       : runtime_(runtime),
         barrierTracer_(barrierTracerArg),
-        needsIncrementalBarrier_(false)
+        needsIncrementalBarrier_(false),
+        gcState_(NoGC)
     {}
 
+  public:
     bool needsIncrementalBarrier() const {
         return needsIncrementalBarrier_;
     }
 
     JSTracer* barrierTracer() {
         MOZ_ASSERT(needsIncrementalBarrier_);
         MOZ_ASSERT(js::CurrentThreadCanAccessRuntime(runtime_));
         return barrierTracer_;
@@ -130,16 +140,25 @@ struct Zone
     }
 
     // Note: Unrestricted access to the zone's runtime from an arbitrary
     // thread can easily lead to races. Use this method very carefully.
     JSRuntime* runtimeFromAnyThread() const {
         return runtime_;
     }
 
+    GCState gcState() const { return gcState_; }
+    bool wasGCStarted() const { return gcState_ != NoGC; }
+    bool isGCMarkingBlack() { return gcState_ == Mark; }
+    bool isGCMarkingGray() { return gcState_ == MarkGray; }
+    bool isGCSweeping() { return gcState_ == Sweep; }
+    bool isGCFinished() { return gcState_ == Finished; }
+    bool isGCCompacting() { return gcState_ == Compact; }
+    bool isGCSweepingOrCompacting() { return gcState_ == Sweep || gcState_ == Compact; }
+
     static MOZ_ALWAYS_INLINE JS::shadow::Zone* asShadowZone(JS::Zone* zone) {
         return reinterpret_cast<JS::shadow::Zone*>(zone);
     }
 };
 
 } /* namespace shadow */
 
 /**

--- a/js/public/ProfilingStack.h
+++ b/js/public/ProfilingStack.h
@@ -203,14 +203,11 @@ SetContextProfilingStack(JSContext* cx, 
                          uint32_t max);
 
 JS_FRIEND_API(void)
 EnableContextProfilingStack(JSContext* cx, bool enabled);
 
 JS_FRIEND_API(void)
 RegisterContextProfilingEventMarker(JSContext* cx, void (*fn)(const char*));
 
-JS_FRIEND_API(jsbytecode*)
-ProfilingGetPC(JSContext* cx, JSScript* script, void* ip);
-
 } // namespace js
 
 #endif  /* js_ProfilingStack_h */

--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -955,16 +955,20 @@ IsOptimizedPlaceholderMagicValue(const V
         return true;
     }
     return false;
 }
 
 static MOZ_ALWAYS_INLINE void
 ExposeValueToActiveJS(const Value& v)
 {
+#ifdef DEBUG
+    Value tmp = v;
+    MOZ_ASSERT(!js::gc::EdgeNeedsSweepUnbarrieredSlow(&tmp));
+#endif
     if (v.isGCThing())
         js::gc::ExposeGCThingToActiveJS(GCCellPtr(v));
 }
 
 /************************************************************************/
 
 static inline MOZ_MAY_CALL_AFTER_MUST_RETURN Value
 NullValue()

--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -25,18 +25,17 @@
 #include "vm/NativeObject-inl.h"
 
 using namespace js;
 
 static double
 MillisecondsSinceStartup()
 {
     auto now = mozilla::TimeStamp::Now();
-    bool ignored;
-    return (now - mozilla::TimeStamp::ProcessCreation(ignored)).ToMilliseconds();
+    return (now - mozilla::TimeStamp::ProcessCreation()).ToMilliseconds();
 }
 
 enum PromiseHandler {
     PromiseHandlerIdentity = 0,
     PromiseHandlerThrower,
     PromiseHandlerAsyncFunctionAwaitFulfilled,
     PromiseHandlerAsyncFunctionAwaitRejected,
     PromiseHandlerAsyncGeneratorAwaitFulfilled,

--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -4313,19 +4313,18 @@ AflLoop(JSContext* cx, unsigned argc, Va
     return true;
 }
 #endif
 
 static bool
 TimeSinceCreation(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    bool ignore;
-    double when = (mozilla::TimeStamp::Now()
-                   - mozilla::TimeStamp::ProcessCreation(ignore)).ToMilliseconds();
+    double when = (mozilla::TimeStamp::Now() -
+                   mozilla::TimeStamp::ProcessCreation()).ToMilliseconds();
     args.rval().setNumber(when);
     return true;
 }
 
 static bool
 GetErrorNotes(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);

--- a/js/src/devtools/rootAnalysis/README.md
+++ b/js/src/devtools/rootAnalysis/README.md
@@ -1,14 +1,67 @@
 # Spidermonkey JSAPI rooting analysis
 
 This directory contains scripts for running Brian Hackett's static GC rooting
-analysis on a JS source directory.
+and thread heap write safety analyses on a JS source directory.
+
+The easiest way to get this running is to not try to do the instrumented
+compilation locally. Instead, grab the relevant files from a try server push
+and analyze them locally.
+
+Local Analysis of Downloaded Intermediate Files
+
+1. Do a try push with "--upload-xdbs" appended to the try: ..." line.
+
+2. Create an empty directory to run the analysis.
+
+3. When the try job is complete, download the resulting src_body.xdb.bz2, src_comp.xdb.bz2,
+and file_source.xdb.bz2 files into your directory.
+
+4. Build an optimized JS shell with ctypes. Note that this does not need to
+match the source you are analyzing in any way; in fact, you pretty much never
+need to update this once you've built it. (Though I reserve the right to use
+any new JS features implemented in Spidermonkey in the future...)
+
+    mkdir <objdir>
+    cd <objdir>
+    <srcpath>/js/src/configure --disable-debug --enable-optimize --enable-ctypes
+    make -j6 -s
+
+5. Clone and build sixgill:
 
-To use it on SpiderMonkey:
+    hg clone https://hg.mozilla.org/users/sfink_mozilla.com/sixgill
+    cd sixgill
+    ./release.sh --build
+
+If you are on osx, the sixgill build will fail horribly. Let it, then do
+
+    make bin/xdb.so CXX=clang++
+
+6. Make a defaults.py file containing the following, with your own paths filled in:
+
+    js = "<objdir>/dist/bin/js"
+    sixgill_bin = "<sixgill-dir>/bin"
+
+7a. For the rooting analysis, run
+
+    python <srcdir>/js/src/devtools/rootAnalysis/analyze.py gcTypes
+
+7b. For the heap write analysis, run
+
+    python <srcdir>/js/src/devtools/rootAnalysis/analyze.py heapwrites
+
+Also, you may wish to run with -v (aka --verbose) to see the exact commands
+executed that you can cut & paste if needed. (I use them to run under the JS
+debugger when I'm working on the analysis.)
+
+----
+
+Or if you *do* want to run the full analysis locally, then you may face the
+dragons. To use it on SpiderMonkey:
 
 1.  Be on Fedora/CentOS/RedHat Linux x86_64, or a Docker image of one of those.
 
     Specifically, the prebuilt GCC **won't work on Ubuntu**
     without the `CFLAGS` and `CXXFLAGS` settings from
     <http://trac.wildfiregames.com/wiki/StaticRootingAnalysis>.
 
 2.  Have the Gecko build prerequisites installed.

--- a/js/src/devtools/rootAnalysis/analyze.py
+++ b/js/src/devtools/rootAnalysis/analyze.py
@@ -11,16 +11,26 @@ Runs the static rooting analysis
 
 from subprocess import Popen
 import subprocess
 import os
 import argparse
 import sys
 import re
 
+# Python 2/3 version independence polyfills
+
+anystring_t = str if sys.version_info[0] > 2 else basestring
+
+try:
+    execfile
+except:
+    def execfile(thefile, globals):
+        exec(compile(open(thefile).read(), filename=thefile, mode="exec"), globals)
+
 def env(config):
     e = dict(os.environ)
     e['PATH'] = ':'.join(p for p in (config.get('gcc_bin'), config.get('sixgill_bin'), e['PATH']) if p)
     e['XDB'] = '%(sixgill_bin)s/xdb.so' % config
     e['SOURCE'] = config['source']
     e['ANALYZED_OBJDIR'] = config['objdir']
     return e
 
@@ -56,17 +66,17 @@ def print_command(command, outfile=None,
                     outputs.append('%s="%s${%s}%s"' % (key,
                                                        value[:start],
                                                        key,
                                                        value[end:]))
                 else:
                     outputs.append("%s='%s'" % (key, value))
             output = ' '.join(outputs) + " " + output
 
-    print output
+    print(output)
 
 def generate_hazards(config, outfilename):
     jobs = []
     for i in range(int(config['jobs'])):
         command = fill(('%(js)s',
                         '%(analysis_scriptdir)s/analyzeRoots.js',
                         '%(gcFunctions_list)s',
                         '%(gcEdges)s',
@@ -93,17 +103,17 @@ def generate_hazards(config, outfilename
 
     with open(outfilename, 'w') as output:
         command = ['cat'] + [ 'rootingHazards.%s' % (i+1,) for i in range(int(config['jobs'])) ]
         if config['verbose']:
             print_command(command, outfile=outfilename)
         subprocess.call(command, stdout=output)
 
 JOBS = { 'dbs':
-             (('%(ANALYSIS_SCRIPTDIR)s/run_complete',
+             (('%(analysis_scriptdir)s/run_complete',
                '--foreground',
                '--no-logs',
                '--build-root=%(objdir)s',
                '--wrap-dir=%(sixgill)s/scripts/wrap_gcc',
                '--work-dir=work',
                '-b', '%(sixgill_bin)s',
                '--buildcommand=%(buildcommand)s',
                '.'),
@@ -155,17 +165,17 @@ def out_indexes(command):
 def run_job(name, config):
     cmdspec, outfiles = JOBS[name]
     print("Running " + name + " to generate " + str(outfiles))
     if hasattr(cmdspec, '__call__'):
         cmdspec(config, outfiles)
     else:
         temp_map = {}
         cmdspec = fill(cmdspec, config)
-        if isinstance(outfiles, basestring):
+        if isinstance(outfiles, anystring_t):
             stdout_filename = '%s.tmp' % name
             temp_map[stdout_filename] = outfiles
             if config['verbose']:
                 print_command(cmdspec, outfile=outfiles, env=env(config))
         else:
             stdout_filename = None
             pc = list(cmdspec)
             outfile = 0
@@ -190,19 +200,19 @@ def run_job(name, config):
                 subprocess.check_call(command, stdout=output, env=env(config))
         for (temp, final) in temp_map.items():
             try:
                 os.rename(temp, final)
             except OSError:
                 print("Error renaming %s -> %s" % (temp, final))
                 raise
 
-config = { 'ANALYSIS_SCRIPTDIR': os.path.dirname(__file__) }
+config = { 'analysis_scriptdir': os.path.dirname(__file__) }
 
-defaults = [ '%s/defaults.py' % config['ANALYSIS_SCRIPTDIR'],
+defaults = [ '%s/defaults.py' % config['analysis_scriptdir'],
              '%s/defaults.py' % os.getcwd() ]
 
 parser = argparse.ArgumentParser(description='Statically analyze build tree for rooting hazards.')
 parser.add_argument('step', metavar='STEP', type=str, nargs='?',
                     help='run starting from this step')
 parser.add_argument('--source', metavar='SOURCE', type=str, nargs='?',
                     help='source code to analyze')
 parser.add_argument('--objdir', metavar='DIR', type=str, nargs='?',
@@ -255,19 +265,24 @@ elif 'BUILD' in os.environ:
 else:
     data['buildcommand'] = 'make -j4 -s'
 
 if 'ANALYZED_OBJDIR' in os.environ:
     data['objdir'] = os.environ['ANALYZED_OBJDIR']
 
 if 'SOURCE' in os.environ:
     data['source'] = os.environ['SOURCE']
-if not data.get('source') and data.get('sixgill_bin'):
-    path = subprocess.check_output(['sh', '-c', data['sixgill_bin'] + '/xdbkeys file_source.xdb | grep jsapi.cpp'])
-    data['source'] = path.replace("\n", "").replace("/js/src/jsapi.cpp", "")
+
+if data.get('sixgill_bin'):
+    if not data.get('source'):
+        path = subprocess.check_output(['sh', '-c', data['sixgill_bin'] + '/xdbkeys file_source.xdb | grep jsapi.cpp']).decode()
+        data['source'] = path.replace("\n", "").replace("/js/src/jsapi.cpp", "")
+    if not data.get('objdir'):
+        path = subprocess.check_output(['sh', '-c', data['sixgill_bin'] + '/xdbkeys file_source.xdb | grep jsapi.h']).decode()
+        data['objdir'] = path.replace("\n", "").replace("/jsapi.h", "")
 
 steps = [ 'dbs',
           'gcTypes',
           'callgraph',
           'gcFunctions',
           'allFunctions',
           'hazards',
           'explain',
@@ -279,17 +294,17 @@ if args.list:
         if outfilename:
             print("%s -> %s" % (step, outfilename))
         else:
             print(step)
     sys.exit(0)
 
 for step in steps:
     command, outfiles = JOBS[step]
-    if isinstance(outfiles, basestring):
+    if isinstance(outfiles, anystring_t):
         data[step] = outfiles
     else:
         outfile = 0
         for (i, name) in out_indexes(command):
             data[name] = outfiles[outfile]
             outfile += 1
         assert len(outfiles) == outfile, 'step \'%s\': mismatched number of output files (%d) and params (%d)' % (step, outfile, len(outfiles))
 

--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -1070,41 +1070,54 @@ function isSafeVariable(entry, variable)
         // Hopefully the construction code doesn't leak pointers to the object
         // to places where other threads might access it.
         if (isDirectCall(edge, /operator new/) ||
             isDirectCall(edge, /nsCSSValue::Array::Create/))
         {
             return true;
         }
 
-        // References to the contents of an array are threadsafe if the array
-        // itself is threadsafe.
-        if ((isDirectCall(edge, /operator\[\]/) ||
-             isDirectCall(edge, /nsStyleContent::ContentAt/)) &&
-            isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
-        {
-            return true;
-        }
-
-        // Watch for the coerced result of a getter_AddRefs call.
-        if (isDirectCall(edge, /operator /)) {
-            var otherEdge = expressionValueEdge(edge.PEdgeCallInstance.Exp);
-            if (otherEdge &&
-                isDirectCall(otherEdge, /getter_AddRefs/) &&
-                isEdgeSafeArgument(entry, otherEdge.PEdgeCallArguments.Exp[0]))
+        if ("PEdgeCallInstance" in edge) {
+            // References to the contents of an array are threadsafe if the array
+            // itself is threadsafe.
+            if ((isDirectCall(edge, /operator\[\]/) ||
+                 isDirectCall(edge, /nsStyleContent::ContentAt/)) &&
+                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
             {
                 return true;
             }
-        }
+
+            // Watch for the coerced result of a getter_AddRefs call.
+            if (isDirectCall(edge, /operator /)) {
+                var otherEdge = expressionValueEdge(edge.PEdgeCallInstance.Exp);
+                if (otherEdge &&
+                    isDirectCall(otherEdge, /getter_AddRefs/) &&
+                    isEdgeSafeArgument(entry, otherEdge.PEdgeCallArguments.Exp[0]))
+                {
+                    return true;
+                }
+            }
 
-        // Coercion via AsAString preserves safety.
-        if (isDirectCall(edge, /AsAString/) &&
-            isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
-        {
-            return true;
+            // Placement-new returns a pointer that is as safe as the pointer
+            // passed to it. Exp[0] is the size, Exp[1] is the pointer/address.
+            // Note that the invocation of the constructor is a separate call,
+            // and so need not be considered here.
+            if (isDirectCall(edge, /operator new/) &&
+                edge.PEdgeCallInstance.Exp.length == 2 &&
+                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp[1]))
+            {
+                return true;
+            }
+
+            // Coercion via AsAString preserves safety.
+            if (isDirectCall(edge, /AsAString/) &&
+                isEdgeSafeArgument(entry, edge.PEdgeCallInstance.Exp))
+            {
+                return true;
+            }
         }
 
         // Watch out for variables which were assigned arguments.
         var rhsVariable = variableAssignRhs(edge);
         if (rhsVariable)
             return isSafeVariable(entry, rhsVariable);
     }
 

--- a/js/src/devtools/rootAnalysis/utility.js
+++ b/js/src/devtools/rootAnalysis/utility.js
@@ -221,21 +221,23 @@ function xdbLibrary()
     } catch (e) {
         // lookup_key is for development use only and is not strictly necessary.
     }
     return api;
 }
 
 function cLibrary()
 {
+    var libPossibilities = ['libc.so.6', 'libc.so', 'libc.dylib'];
     var lib;
-    try {
-        lib = ctypes.open("libc.so.6");
-    } catch(e) {
-        lib = ctypes.open("libc.so");
+    for (const name of libPossibilities) {
+        try {
+            lib = ctypes.open("libc.so.6");
+        } catch(e) {
+        }
     }
 
     return {
         fopen: lib.declare("fopen", ctypes.default_abi, ctypes.void_t.ptr, ctypes.char.ptr, ctypes.char.ptr),
         getline: lib.declare("getline", ctypes.default_abi, ctypes.ssize_t, ctypes.char.ptr.ptr, ctypes.size_t.ptr, ctypes.void_t.ptr),
         fclose: lib.declare("fclose", ctypes.default_abi, ctypes.int, ctypes.void_t.ptr),
         free: lib.declare("free", ctypes.default_abi, ctypes.void_t, ctypes.void_t.ptr),
     };

--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -458,17 +458,17 @@ UsedNameTracker::rewind(RewindToken toke
         r.front().value().resetToScope(token.scriptId, token.scopeId);
 }
 
 FunctionBox::FunctionBox(JSContext* cx, LifoAlloc& alloc, ObjectBox* traceListHead,
                          JSFunction* fun, uint32_t toStringStart,
                          Directives directives, bool extraWarnings,
                          GeneratorKind generatorKind, FunctionAsyncKind asyncKind)
   : ObjectBox(fun, traceListHead),
-    SharedContext(cx, Kind::ObjectBox, directives, extraWarnings),
+    SharedContext(cx, Kind::FunctionBox, directives, extraWarnings),
     enclosingScope_(nullptr),
     namedLambdaBindings_(nullptr),
     functionScopeBindings_(nullptr),
     extraVarScopeBindings_(nullptr),
     functionNode(nullptr),
     bufStart(0),
     bufEnd(0),
     startLine(1),

--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -226,17 +226,17 @@ class SharedContext
     JSContext* const context;
     AnyContextFlags anyCxFlags;
     bool strictScript;
     bool localStrict;
     bool extraWarnings;
 
   protected:
     enum class Kind {
-        ObjectBox,
+        FunctionBox,
         Global,
         Eval,
         Module
     };
 
     Kind kind_;
 
     ThisBinding thisBinding_;
@@ -266,25 +266,23 @@ class SharedContext
         inWith_(false),
         needsThisTDZChecks_(false)
     { }
 
     // If this is the outermost SharedContext, the Scope that encloses
     // it. Otherwise nullptr.
     virtual Scope* compilationEnclosingScope() const = 0;
 
-    virtual ObjectBox* toObjectBox() { return nullptr; }
-    bool isObjectBox() { return toObjectBox(); }
-    bool isFunctionBox() { return isObjectBox() && toObjectBox()->isFunctionBox(); }
+    bool isFunctionBox() const { return kind_ == Kind::FunctionBox; }
     inline FunctionBox* asFunctionBox();
-    bool isModuleContext() { return kind_ == Kind::Module; }
+    bool isModuleContext() const { return kind_ == Kind::Module; }
     inline ModuleSharedContext* asModuleContext();
-    bool isGlobalContext() { return kind_ == Kind::Global; }
+    bool isGlobalContext() const { return kind_ == Kind::Global; }
     inline GlobalSharedContext* asGlobalContext();
-    bool isEvalContext() { return kind_ == Kind::Eval; }
+    bool isEvalContext() const { return kind_ == Kind::Eval; }
     inline EvalSharedContext* asEvalContext();
 
     ThisBinding thisBinding()          const { return thisBinding_; }
 
     bool allowNewTarget()              const { return allowNewTarget_; }
     bool allowSuperProperty()          const { return allowSuperProperty_; }
     bool allowSuperCall()              const { return allowSuperCall_; }
     bool inWith()                      const { return inWith_; }
@@ -449,17 +447,16 @@ class FunctionBox : public ObjectBox, pu
         MOZ_ASSERT(context->keepAtoms);
         return MutableHandle<VarScope::Data*>::fromMarkedLocation(&extraVarScopeBindings_);
     }
 
     void initFromLazyFunction();
     void initStandaloneFunction(Scope* enclosingScope);
     void initWithEnclosingParseContext(ParseContext* enclosing, FunctionSyntaxKind kind);
 
-    ObjectBox* toObjectBox() override { return this; }
     JSFunction* function() const { return &object->as<JSFunction>(); }
 
     Scope* compilationEnclosingScope() const override {
         // This method is used to distinguish the outermost SharedContext. If
         // a FunctionBox is the outermost SharedContext, it must be a lazy
         // function.
         MOZ_ASSERT_IF(function()->isInterpretedLazy(),
                       enclosingScope_ == function()->lazyScript()->enclosingScope());

--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -976,18 +976,18 @@ class GCRuntime
     template <class CompartmentIterT> void markWeakReferences(gcstats::Phase phase);
     void markWeakReferencesInCurrentGroup(gcstats::Phase phase);
     template <class ZoneIterT, class CompartmentIterT> void markGrayReferences(gcstats::Phase phase);
     void markBufferedGrayRoots(JS::Zone* zone);
     void markGrayReferencesInCurrentGroup(gcstats::Phase phase);
     void markAllWeakReferences(gcstats::Phase phase);
     void markAllGrayReferences(gcstats::Phase phase);
 
-    void beginSweepPhase(bool lastGC, AutoLockForExclusiveAccess& lock);
-    void groupZonesForSweeping(AutoLockForExclusiveAccess& lock);
+    void beginSweepPhase(JS::gcreason::Reason reason, AutoLockForExclusiveAccess& lock);
+    void groupZonesForSweeping(JS::gcreason::Reason reason, AutoLockForExclusiveAccess& lock);
     MOZ_MUST_USE bool findInterZoneEdges();
     void getNextSweepGroup();
     void endMarkingSweepGroup();
     void beginSweepingSweepGroup(AutoLockForExclusiveAccess& lock);
     bool shouldReleaseObservedTypes();
     void endSweepingSweepGroup();
     IncrementalProgress performSweepActions(SliceBudget& sliceBudget,
                                             AutoLockForExclusiveAccess& lock);
@@ -1438,17 +1438,18 @@ GCRuntime::upcomingZealousGC() {
 inline bool
 GCRuntime::needZealousGC() {
     if (nextScheduled > 0 && --nextScheduled == 0) {
         if (hasZealMode(ZealMode::Alloc) ||
             hasZealMode(ZealMode::GenerationalGC) ||
             hasZealMode(ZealMode::IncrementalRootsThenFinish) ||
             hasZealMode(ZealMode::IncrementalMarkAllThenFinish) ||
             hasZealMode(ZealMode::IncrementalMultipleSlices) ||
-            hasZealMode(ZealMode::Compact))
+            hasZealMode(ZealMode::Compact) ||
+            hasZealMode(ZealMode::IncrementalSweepThenFinish))
         {
             nextScheduled = zealFrequency;
         }
         return true;
     }
     return false;
 }
 #else

--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -3148,18 +3148,18 @@ IsAboutToBeFinalizedInternal(T** thingp)
     T* thing = *thingp;
     JSRuntime* rt = thing->runtimeFromAnyThread();
 
     /* Permanent atoms are never finalized by non-owning runtimes. */
     if (ThingIsPermanentAtomOrWellKnownSymbol(thing) && TlsContext.get()->runtime() != rt)
         return false;
 
     if (IsInsideNursery(thing)) {
-        MOZ_ASSERT(JS::CurrentThreadIsHeapMinorCollecting());
-        return !Nursery::getForwardedPointer(reinterpret_cast<JSObject**>(thingp));
+        return JS::CurrentThreadIsHeapMinorCollecting() &&
+               !Nursery::getForwardedPointer(reinterpret_cast<JSObject**>(thingp));
     }
 
     Zone* zone = thing->asTenured().zoneFromAnyThread();
     if (zone->isGCSweeping()) {
         return IsAboutToBeFinalizedDuringSweep(thing->asTenured());
     } else if (zone->isGCCompacting() && IsForwarded(thing)) {
         *thingp = Forwarded(thing);
         return false;
@@ -3225,25 +3225,33 @@ IsAboutToBeFinalized(ReadBarrieredBase<T
 
 template <typename T>
 JS_PUBLIC_API(bool)
 EdgeNeedsSweep(JS::Heap<T>* thingp)
 {
     return IsAboutToBeFinalizedInternal(ConvertToBase(thingp->unsafeGet()));
 }
 
+template <typename T>
+JS_PUBLIC_API(bool)
+EdgeNeedsSweepUnbarrieredSlow(T* thingp)
+{
+    return IsAboutToBeFinalizedInternal(ConvertToBase(thingp));
+}
+
 // Instantiate a copy of the Tracing templates for each derived type.
 #define INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS(type) \
     template bool IsMarkedUnbarriered<type>(JSRuntime*, type*);                \
     template bool IsMarked<type>(JSRuntime*, WriteBarrieredBase<type>*); \
     template bool IsAboutToBeFinalizedUnbarriered<type>(type*); \
     template bool IsAboutToBeFinalized<type>(WriteBarrieredBase<type>*); \
     template bool IsAboutToBeFinalized<type>(ReadBarrieredBase<type>*);
 #define INSTANTIATE_ALL_VALID_HEAP_TRACE_FUNCTIONS(type) \
-    template JS_PUBLIC_API(bool) EdgeNeedsSweep<type>(JS::Heap<type>*);
+    template JS_PUBLIC_API(bool) EdgeNeedsSweep<type>(JS::Heap<type>*); \
+    template JS_PUBLIC_API(bool) EdgeNeedsSweepUnbarrieredSlow<type>(type*);
 FOR_EACH_GC_POINTER_TYPE(INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS)
 FOR_EACH_PUBLIC_GC_POINTER_TYPE(INSTANTIATE_ALL_VALID_HEAP_TRACE_FUNCTIONS)
 FOR_EACH_PUBLIC_TAGGED_GC_POINTER_TYPE(INSTANTIATE_ALL_VALID_HEAP_TRACE_FUNCTIONS)
 #undef INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS
 
 } /* namespace gc */
 } /* namespace js */
 

--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -273,18 +273,17 @@ js::gc::GCRuntime::traceRuntimeForMinorG
     // despite having called FinishRoots already. This is because FinishRoots
     // does not clear the crossCompartmentWrapper map. It cannot do this
     // because Proxy's trace for CrossCompartmentWrappers asserts presence in
     // the map. And we can reach its trace function despite having finished the
     // roots via the edges stored by the pre-barrier verifier when we finish
     // the verifier for the last time.
     gcstats::AutoPhase ap(stats(), gcstats::PHASE_MARK_ROOTS);
 
-    // FIXME: As per bug 1298816 comment 12, we should be able to remove this.
-    jit::JitRuntime::TraceJitcodeGlobalTable(trc);
+    jit::JitRuntime::TraceJitcodeGlobalTableForMinorGC(trc);
 
     traceRuntimeCommon(trc, TraceRuntime, lock);
 }
 
 void
 js::TraceRuntime(JSTracer* trc)
 {
     MOZ_ASSERT(!trc->isMarkingTracer());

--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -742,18 +742,17 @@ Statistics::formatJsonSliceDescription(u
 {
     TimeDuration duration = slice.duration();
     lldiv_t durationParts = SplitDurationMS(duration);
     TimeDuration when = slice.start - slices[0].start;
     lldiv_t whenParts = SplitDurationMS(when);
     char budgetDescription[200];
     slice.budget.describe(budgetDescription, sizeof(budgetDescription) - 1);
     int64_t pageFaults = slice.endFaults - slice.startFaults;
-    bool ignore;
-    TimeStamp originTime = TimeStamp::ProcessCreation(ignore);
+    TimeStamp originTime = TimeStamp::ProcessCreation();
 
     const char* format =
         "\"slice\":%d,"
         "\"pause\":%llu.%03llu,"
         "\"when\":%llu.%03llu,"
         "\"reason\":\"%s\","
         "\"initial_state\":\"%s\","
         "\"final_state\":\"%s\","
@@ -1024,19 +1023,18 @@ LongestPhaseSelfTime(const Statistics::P
 void
 Statistics::printStats()
 {
     if (aborted) {
         fprintf(fp, "OOM during GC statistics collection. The report is unavailable for this GC.\n");
     } else {
         UniqueChars msg = formatDetailedMessage();
         if (msg) {
-            bool ignoredInconsistency;
             double secSinceStart =
-                (slices[0].start - TimeStamp::ProcessCreation(ignoredInconsistency)).ToSeconds();
+                (slices[0].start - TimeStamp::ProcessCreation()).ToSeconds();
             fprintf(fp, "GC(T+%.3fs) %s\n", secSinceStart, msg.get());
         }
     }
     fflush(fp);
 }
 
 void
 Statistics::beginGC(JSGCInvocationKind kind)

--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -652,17 +652,18 @@ CheckGrayMarkingTracer::checkCell(Cell* 
         return;
 
     TenuredCell* tenuredCell = &cell->asTenured();
     TenuredCell* tenuredParent = &parent->asTenured();
     if (tenuredParent->isMarked(BLACK) && !tenuredParent->isMarked(GRAY) &&
         tenuredCell->isMarked(GRAY))
     {
         failures++;
-        fprintf(stderr, "Found black to gray edge %p\n", cell);
+        fprintf(stderr, "Found black to gray edge to %s %p\n",
+                GCTraceKindToAscii(cell->getTraceKind()), cell);
         dumpCellPath();
     }
 }
 
 bool
 CheckGrayMarkingTracer::check(AutoLockForExclusiveAccess& lock)
 {
     if (!traceHeap(lock))

--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -50,17 +50,16 @@ JS::Zone::Zone(JSRuntime* rt, ZoneGroup*
     baseShapes_(group, this, BaseShapeSet()),
     initialShapes_(group, this, InitialShapeSet()),
     data(group, nullptr),
     isSystem(group, false),
 #ifdef DEBUG
     gcLastSweepGroupIndex(group, 0),
 #endif
     jitZone_(group, nullptr),
-    gcState_(NoGC),
     gcScheduled_(false),
     gcPreserveCode_(group, false),
     jitUsingBarriers_(group, false),
     keepShapeTables_(group, false),
     listNext_(group, NotOnList)
 {
     /* Ensure that there are no vtables to mess us up here. */
     MOZ_ASSERT(reinterpret_cast<JS::shadow::Zone*>(this) ==

--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -210,24 +210,16 @@ struct Zone : public JS::shadow::Zone,
 
     void setPreservingCode(bool preserving) { gcPreserveCode_ = preserving; }
     bool isPreservingCode() const { return gcPreserveCode_; }
 
     bool canCollect();
 
     void notifyObservingDebuggers();
 
-    enum GCState {
-        NoGC,
-        Mark,
-        MarkGray,
-        Sweep,
-        Finished,
-        Compact
-    };
     void setGCState(GCState state) {
         MOZ_ASSERT(CurrentThreadIsHeapBusy());
         MOZ_ASSERT_IF(state != NoGC, canCollect());
         gcState_ = state;
         if (state == Finished)
             notifyObservingDebuggers();
     }
 
@@ -252,25 +244,16 @@ struct Zone : public JS::shadow::Zone,
 
     bool isGCMarking() {
         if (CurrentThreadIsHeapCollecting())
             return gcState_ == Mark || gcState_ == MarkGray;
         else
             return needsIncrementalBarrier();
     }
 
-    GCState gcState() const { return gcState_; }
-    bool wasGCStarted() const { return gcState_ != NoGC; }
-    bool isGCMarkingBlack() { return gcState_ == Mark; }
-    bool isGCMarkingGray() { return gcState_ == MarkGray; }
-    bool isGCSweeping() { return gcState_ == Sweep; }
-    bool isGCFinished() { return gcState_ == Finished; }
-    bool isGCCompacting() { return gcState_ == Compact; }
-    bool isGCSweepingOrCompacting() { return gcState_ == Sweep || gcState_ == Compact; }
-
     // Get a number that is incremented whenever this zone is collected, and
     // possibly at other times too.
     uint64_t gcNumber();
 
     bool compileBarriers() const { return compileBarriers(needsIncrementalBarrier()); }
     bool compileBarriers(bool needsIncrementalBarrier) const {
         return needsIncrementalBarrier ||
                runtimeFromActiveCooperatingThread()->hasZealMode(js::gc::ZealMode::VerifierPre);
@@ -616,17 +599,16 @@ struct Zone : public JS::shadow::Zone,
     }
     void setKeepShapeTables(bool b) {
         keepShapeTables_ = b;
     }
 
   private:
     js::ZoneGroupData<js::jit::JitZone*> jitZone_;
 
-    js::UnprotectedData<GCState> gcState_;
     js::ActiveThreadData<bool> gcScheduled_;
     js::ZoneGroupData<bool> gcPreserveCode_;
     js::ZoneGroupData<bool> jitUsingBarriers_;
     js::ZoneGroupData<bool> keepShapeTables_;
 
     // Allow zones to be linked into a list
     friend class js::gc::ZoneList;
     static Zone * const NotOnList;

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/testBug1359612.js
@@ -0,0 +1,9 @@
+load(libdir + 'asm.js');
+
+asmLink(asmCompile('stdlib', 'foreign', USE_ASM + `
+  var ff = foreign.ff;
+  function f() {
+      ff(+1);
+  }
+  return f
+`), this, { ff: Math.log1p });

--- a/js/src/jit-test/tests/gc/incremental-state.js
+++ b/js/src/jit-test/tests/gc/incremental-state.js
@@ -22,42 +22,45 @@ gcslice(1);
 assertEq(gcstate(), "Mark");
 gcslice(1000000);
 assertEq(gcstate(), "Mark");
 gcslice(1000000);
 while (gcstate() == "Finalize") { gcslice(1); }
 while (gcstate() == "Decommit") { gcslice(1); }
 assertEq(gcstate(), "NotActive");
 
-// Zeal mode 8: Incremental GC in two main slices:
+// Zeal mode 8: Incremental GC in two slices:
 //   1) mark roots
 //   2) mark and sweep
-//   *) finalize.
 gczeal(8, 0);
 gcslice(1);
 assertEq(gcstate(), "Mark");
 gcslice(1);
-while (gcstate() == "Finalize") { gcslice(1); }
-while (gcstate() == "Decommit") { gcslice(1); }
 assertEq(gcstate(), "NotActive");
 
-// Zeal mode 9: Incremental GC in two main slices:
+// Zeal mode 9: Incremental GC in two slices:
 //   1) mark roots and marking
 //   2) new marking and sweeping
-//   *) finalize.
 gczeal(9, 0);
 gcslice(1);
 assertEq(gcstate(), "Mark");
 gcslice(1);
-while (gcstate() == "Finalize") { gcslice(1); }
-while (gcstate() == "Decommit") { gcslice(1); }
 assertEq(gcstate(), "NotActive");
 
 // Zeal mode 10: Incremental GC in multiple slices (always yeilds before
 // sweeping). This test uses long slices to prove that this zeal mode yields
 // in sweeping, where normal IGC (above) does not.
 gczeal(10, 0);
 gcslice(1000000);
 assertEq(gcstate(), "Sweep");
 gcslice(1000000);
 while (gcstate() == "Finalize") { gcslice(1); }
 while (gcstate() == "Decommit") { gcslice(1); }
 assertEq(gcstate(), "NotActive");
+
+// Zeal mode 17: Incremental GC in two slices:
+//   1) mark everything and start sweeping
+//   2) finish sweeping
+gczeal(17, 0);
+gcslice(1);
+assertEq(gcstate(), "Sweep");
+gcslice(1);
+assertEq(gcstate(), "NotActive");

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/builtin-import-sigs.js
@@ -0,0 +1,15 @@
+var code = wasmTextToBinary(`(module
+    (import $one "" "builtin")
+    (import $two "" "builtin" (param i32))
+    (import $three "" "builtin" (result i32))
+    (import $four "" "builtin" (result f32) (param f32 f32 f32 f32 f32 f32 f32 f32 f32 f32 f32 f32))
+    (func (export "run")
+        (call $one)
+        (call $two (i32.const 0))
+        (drop (call $three))
+        (drop (call $four (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0) (f32.const 0)))
+    )
+)`);
+var m = new WebAssembly.Module(code);
+var i = new WebAssembly.Instance(m, {'':{builtin:Math.sin}});
+i.exports.run();

--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -609,23 +609,23 @@ JitRuntime::Trace(JSTracer* trc, AutoLoc
     Zone* zone = trc->runtime()->atomsCompartment(lock)->zone();
     for (auto i = zone->cellIter<JitCode>(); !i.done(); i.next()) {
         JitCode* code = i;
         TraceRoot(trc, &code, "wrapper");
     }
 }
 
 /* static */ void
-JitRuntime::TraceJitcodeGlobalTable(JSTracer* trc)
+JitRuntime::TraceJitcodeGlobalTableForMinorGC(JSTracer* trc)
 {
     if (trc->runtime()->geckoProfiler().enabled() &&
         trc->runtime()->hasJitRuntime() &&
         trc->runtime()->jitRuntime()->hasJitcodeGlobalTable())
     {
-        trc->runtime()->jitRuntime()->getJitcodeGlobalTable()->trace(trc);
+        trc->runtime()->jitRuntime()->getJitcodeGlobalTable()->traceForMinorGC(trc);
     }
 }
 
 /* static */ bool
 JitRuntime::MarkJitcodeGlobalTableIteratively(GCMarker* marker)
 {
     if (marker->runtime()->hasJitRuntime() &&
         marker->runtime()->jitRuntime()->hasJitcodeGlobalTable())

--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12011,18 +12011,20 @@ IonBuilder::jsop_lambda(JSFunction* fun)
 AbortReasonOr<Ok>
 IonBuilder::jsop_lambda_arrow(JSFunction* fun)
 {
     MOZ_ASSERT(analysis().usesEnvironmentChain());
     MOZ_ASSERT(fun->isArrow());
     MOZ_ASSERT(!fun->isNative());
 
     MDefinition* newTargetDef = current->pop();
+    MConstant* cst = MConstant::NewConstraintlessObject(alloc(), fun);
+    current->add(cst);
     MLambdaArrow* ins = MLambdaArrow::New(alloc(), constraints(), current->environmentChain(),
-                                          newTargetDef, fun);
+                                          newTargetDef, cst);
     current->add(ins);
     current->push(ins);
 
     return resumeAfter(ins);
 }
 
 AbortReasonOr<Ok>
 IonBuilder::jsop_setfunname(uint8_t prefixKind)

--- a/js/src/jit/JitCompartment.h
+++ b/js/src/jit/JitCompartment.h
@@ -181,17 +181,17 @@ class JitRuntime
     }
 
   public:
     explicit JitRuntime(JSRuntime* rt);
     ~JitRuntime();
     MOZ_MUST_USE bool initialize(JSContext* cx, js::AutoLockForExclusiveAccess& lock);
 
     static void Trace(JSTracer* trc, js::AutoLockForExclusiveAccess& lock);
-    static void TraceJitcodeGlobalTable(JSTracer* trc);
+    static void TraceJitcodeGlobalTableForMinorGC(JSTracer* trc);
     static MOZ_MUST_USE bool MarkJitcodeGlobalTableIteratively(GCMarker* marker);
     static void SweepJitcodeGlobalTable(JSRuntime* rt);
 
     ExecutableAllocator& execAlloc() {
         return execAlloc_.ref();
     }
     ExecutableAllocator& backedgeExecAlloc() {
         return backedgeExecAlloc_.ref();